netfilter: ctnetlink: fix refcount leak on table dump
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.
CVE-2025-38721
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-38721
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "d205dc40798d97d63ad348bfaf7394f445d152d4",
"lessThan": "586892e341fbf698e7cbaca293e1353957db725a",
"versionType": "git"
},
{
"status": "affected",
"version": "d205dc40798d97d63ad348bfaf7394f445d152d4",
"lessThan": "962518c6ca9f9a13df099cafa429f72f68ad61f0",
"versionType": "git"
},
{
"status": "affected",
"version": "d205dc40798d97d63ad348bfaf7394f445d152d4",
"lessThan": "19b909a4b1452fb97e477d2f08b97f8d04095619",
"versionType": "git"
},
{
"status": "affected",
"version": "d205dc40798d97d63ad348bfaf7394f445d152d4",
"lessThan": "41462f4cfc583513833f87f9ee55d12da651a7e3",
"versionType": "git"
},
{
"status": "affected",
"version": "d205dc40798d97d63ad348bfaf7394f445d152d4",
"lessThan": "30cf811058552b8cd0e98dff677ef3f89d6d34ce",
"versionType": "git"
},
{
"status": "affected",
"version": "d205dc40798d97d63ad348bfaf7394f445d152d4",
"lessThan": "a2cb4df7872de069f809de2f076ec8e54d649fe3",
"versionType": "git"
},
{
"status": "affected",
"version": "d205dc40798d97d63ad348bfaf7394f445d152d4",
"lessThan": "e14f72aa66c029db106921d621edcedef68e065b",
"versionType": "git"
},
{
"status": "affected",
"version": "d205dc40798d97d63ad348bfaf7394f445d152d4",
"lessThan": "a62d6aa3f31f216b637a4c71b7a8bfc7c57f049b",
"versionType": "git"
},
{
"status": "affected",
"version": "d205dc40798d97d63ad348bfaf7394f445d152d4",
"lessThan": "de788b2e6227462b6dcd0e07474e72c089008f74",
"versionType": "git"
}
],
"programFiles": [
"net/netfilter/nf_conntrack_netlink.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.4.297",
"versionType": "semver",
"lessThanOrEqual": "5.4.*"
},
{
"status": "unaffected",
"version": "5.10.241",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.190",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.149",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.103",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.43",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.15.11",
"versionType": "semver",
"lessThanOrEqual": "6.15.*"
},
{
"status": "unaffected",
"version": "6.16.2",
"versionType": "semver",
"lessThanOrEqual": "6.16.*"
},
{
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/netfilter/nf_conntrack_netlink.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-38721
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #27051 · Revision 1
- Added to Heist Feed
- Publisher date