Critical Memory Leak Vulnerability in Linux Kernel - CVE-2025-38120
Summary
CVE-2025-38120: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo_avx2: fix initial map fill If the first field doesn't cover the entire start map, then we must zero out the remainder, else we... Affects linux versions < 6.1.147-1. Fixed in 6.1.147-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. However, vulnerabilities can arise, impacting its reliability and security. CVE-2025-38120 specifically affects the netfilter subsystem, which is responsible for packet filtering and network address translation, making it crucial for network security.
Vulnerability Detail
CVE-2025-38120 is a vulnerability in the Linux kernel's netfilter subsystem, specifically in the nf_set_pipapo_avx2 function. The issue arises when the first field does not completely cover the start map, leading to uninitialized memory being exposed in subsequent match rounds. This can result in sensitive data leakage, potentially allowing attackers to exploit the system. The initial fix was incomplete, addressing only the generic C implementation, necessitating a follow-up patch to ensure comprehensive security.
How To Fix
Minimum fixed version
6.1.147-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the use of the affected netfilter features until the patch is applied. This may involve disabling certain network filtering rules that utilize the nf_set_pipapo_avx2 function, although this is not a permanent solution.
Conclusion
CVE-2025-38120 is a significant vulnerability in the Linux kernel that requires immediate attention. Updating to the latest patched version is crucial to ensure system security. Temporary workarounds can be employed until the patch is applied, but they do not provide a permanent solution. Regular monitoring for vulnerabilities using tools like Vulert is recommended.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38120 is a vulnerability in the Linux kernel that can lead to memory leaks and potential data exposure.
If exploited, this vulnerability can allow attackers to access sensitive information from memory, compromising system security.
Yes, a patch has been released. You should update your Linux package to the latest version to mitigate the risk.
Consider applying temporary workarounds, such as disabling specific netfilter features until the patch can be applied.
You can use Vulert, which monitors open-source vulnerabilities in real-time using a manifest file. Check your application against CVE-2025-38120 using the Vulert playground at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
