Skip to content
Heist/ feed
Back to feed
UnratedFix available

netfilter: ctnetlink: fix refcount leak on table dump

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.241, 5.15.190, 5.4.297, 6.1.149, 6.12.43, 6.15.11, 6.16.2, 6.6.103
CVEs
CVE-2025-38721
Confirmed fixed CVEs
Not specified
Updated in this feed
2 Nov 2026, 22:43 UTC · Revision 1

Source evidence

netfilter: ctnetlink: fix refcount leak on table dump

core-osv · Original source

Published 4 Sept 2025, 15:33 UTC

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.

osv:CVE-2025-38721

Kernel

Fixed versions: 5.4.297, 5.10.241, 5.15.190, 6.1.149, 6.6.103, 6.12.43, 6.15.11, 6.16.2

Complete source record
{
  "id": "7f230c4b61a1e356efb3bc80b82fa46b333b8ccfc0608d09fcc973ef3f35f6a4",
  "url": "https://osv.dev/vulnerability/CVE-2025-38721",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "netfilter: ctnetlink: fix refcount leak on table dump",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.",
    "evidence": "osv:CVE-2025-38721",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.4.297",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.10.241",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.190",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.149",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.103",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.43",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.15.11",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.16.2",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2025-38721",
      "aliases": [
        "CVE-2025-38721"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "d205dc40798d97d63ad348bfaf7394f445d152d4"
                },
                {
                  "fixed": "586892e341fbf698e7cbaca293e1353957db725a"
                },
                {
                  "fixed": "962518c6ca9f9a13df099cafa429f72f68ad61f0"
                },
                {
                  "fixed": "19b909a4b1452fb97e477d2f08b97f8d04095619"
                },
                {
                  "fixed": "41462f4cfc583513833f87f9ee55d12da651a7e3"
                },
                {
                  "fixed": "30cf811058552b8cd0e98dff677ef3f89d6d34ce"
                },
                {
                  "fixed": "a2cb4df7872de069f809de2f076ec8e54d649fe3"
                },
                {
                  "fixed": "e14f72aa66c029db106921d621edcedef68e065b"
                },
                {
                  "fixed": "a62d6aa3f31f216b637a4c71b7a8bfc7c57f049b"
                },
                {
                  "fixed": "de788b2e6227462b6dcd0e07474e72c089008f74"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38721.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "2.6.18"
                },
                {
                  "fixed": "5.4.297"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.5.0"
                },
                {
                  "fixed": "5.10.241"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.190"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.149"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.103"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.43"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.15.11"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.16.0"
                },
                {
                  "fixed": "6.16.2"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38721.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:23.961670195Z",
      "provider": "osv",
      "references": [
        "https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-032379.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-082556.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-457936.html",
        "https://git.kernel.org/stable/c/19b909a4b1452fb97e477d2f08b97f8d04095619",
        "https://git.kernel.org/stable/c/30cf811058552b8cd0e98dff677ef3f89d6d34ce",
        "https://git.kernel.org/stable/c/41462f4cfc583513833f87f9ee55d12da651a7e3",
        "https://git.kernel.org/stable/c/586892e341fbf698e7cbaca293e1353957db725a",
        "https://git.kernel.org/stable/c/962518c6ca9f9a13df099cafa429f72f68ad61f0",
        "https://git.kernel.org/stable/c/a2cb4df7872de069f809de2f076ec8e54d649fe3",
        "https://git.kernel.org/stable/c/a62d6aa3f31f216b637a4c71b7a8bfc7c57f049b",
        "https://git.kernel.org/stable/c/de788b2e6227462b6dcd0e07474e72c089008f74",
        "https://git.kernel.org/stable/c/e14f72aa66c029db106921d621edcedef68e065b",
        "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html",
        "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38721.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-38721",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38721.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-38721",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 490637,
  "published_at": "2025-09-04T15:33:14.891+00:00"
}