CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftsetpipapo: clamp maximum map bucket size to INTMAX
Otherwise, it is possible to hit WARNONONCE in kvmallocnodenoprof() when resizing hashtable because GFPNOWARN is unset.
Similar to:
b541ba7d1f5a ("netfilter: conntrack: clamp maximum hashtable size to INTMAX")
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38201?
CVE-2025-38201 has been classified with a medium severity level due to its potential impact on system stability.
How do I fix CVE-2025-38201?
To fix CVE-2025-38201, update to the latest version of the Linux kernel that resolves this vulnerability.
What products are affected by CVE-2025-38201?
CVE-2025-38201 affects multiple versions of the Linux kernel.
What are the potential consequences of CVE-2025-38201?
The potential consequences of CVE-2025-38201 include increased risk of system instability and possible exploitation that could lead to denial of service.
Who reported CVE-2025-38201?
The CVE-2025-38201 vulnerability was reported as part of routine kernel vulnerability assessments conducted by the Linux community.