CVE-2025-21958: Revert "openvswitch: switch to per-action label counting in conntrack"
In the Linux kernel, the following vulnerability has been resolved:
Revert "openvswitch: switch to per-action label counting in conntrack"
Currently, ovsctsetlabels() is only called for confirmed conntrack entries (ct) within ovsctcommit(). However, if the conntrack entry does not have the labelsext extension, attempting to allocate it in ovsctgetconnlabels() for a confirmed entry triggers a warning in nfctextadd():
WARNON(nfctisconfirmed(ct));
This happens when the conntrack entry is created externally before OVS increments net->ct.labelsused. The issue has become more likely since commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting in conntrack"), which changed to use per-action label counting and increment net->ct.labelsused when a flow with ct action is added.
Since there’s no straightforward way to fully resolve this issue at the moment, this reverts the commit to avoid breaking existing use cases.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-21958?
CVE-2025-21958 is classified as a high-severity vulnerability affecting the Linux kernel and Open vSwitch.
How do I fix CVE-2025-21958?
To fix CVE-2025-21958, update your Linux kernel or Open vSwitch software to the latest patched version.
Which versions of Linux kernel are affected by CVE-2025-21958?
CVE-2025-21958 affects specific versions of the Linux kernel that implemented the vulnerable conntrack functionality.
What kind of systems are impacted by CVE-2025-21958?
Systems running vulnerable versions of the Linux kernel or Open vSwitch are at risk due to CVE-2025-21958.
What is the nature of the vulnerability in CVE-2025-21958?
CVE-2025-21958 is a vulnerability related to improper label counting in connection tracking within the Linux kernel.