Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-38721

netfilter: ctnetlink: fix refcount leak on table dump

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • d205dc40798d97d63ad348bfaf7394f445d152d4 to < 586892e341fbf698e7cbaca293e1353957db725aaffected
  • d205dc40798d97d63ad348bfaf7394f445d152d4 to < 962518c6ca9f9a13df099cafa429f72f68ad61f0affected
  • d205dc40798d97d63ad348bfaf7394f445d152d4 to < 19b909a4b1452fb97e477d2f08b97f8d04095619affected
  • d205dc40798d97d63ad348bfaf7394f445d152d4 to < 41462f4cfc583513833f87f9ee55d12da651a7e3affected
  • d205dc40798d97d63ad348bfaf7394f445d152d4 to < 30cf811058552b8cd0e98dff677ef3f89d6d34ceaffected
  • d205dc40798d97d63ad348bfaf7394f445d152d4 to < a2cb4df7872de069f809de2f076ec8e54d649fe3affected
  • d205dc40798d97d63ad348bfaf7394f445d152d4 to < e14f72aa66c029db106921d621edcedef68e065baffected
  • d205dc40798d97d63ad348bfaf7394f445d152d4 to < a62d6aa3f31f216b637a4c71b7a8bfc7c57f049baffected
  • d205dc40798d97d63ad348bfaf7394f445d152d4 to < de788b2e6227462b6dcd0e07474e72c089008f74affected

Linux Linux

Default version status: affected

  • 2.6.18affected
  • 0 to < 2.6.18unaffected
  • 5.4.297 to ≤ 5.4.*unaffected
  • 5.10.241 to ≤ 5.10.*unaffected
  • 5.15.190 to ≤ 5.15.*unaffected
  • 6.1.149 to ≤ 6.1.*unaffected
  • 6.6.103 to ≤ 6.6.*unaffected
  • 6.12.43 to ≤ 6.12.*unaffected
  • 6.15.11 to ≤ 6.15.*unaffected
  • 6.16.2 to ≤ 6.16.*unaffected
  • 6.17 to ≤ *unaffected

References