PT-2025-35994 · Linux+6 · Linux Kernel+6
Published
2025-08-01
·
Updated
2026-05-26
·
CVE-2025-38721
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A reference count leak exists in the
ctnetlink dump table() function within the netfilter module. This leak can occur when a conntrack object's reference count is incremented unnecessarily, preventing the object from being released and potentially blocking network namespace dismantling or conntrack module removal. The issue can be reproduced by repeatedly running the conntrack resize.sh selftest script. The root cause is an unnecessary reference counting operation that can lead to a runaway kworker spinning in nf conntrack cleanup net list().Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu
Netfilter