CVE-2025-38201: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftsetpipapo: clamp maximum map bucket size to INTMAX
Otherwise, it is possible to hit WARNONONCE in kvmallocnodenoprof() when resizing hashtable because GFPNOWARN is unset.
Similar to:
b541ba7d1f5a ("netfilter: conntrack: clamp maximum hashtable size to INTMAX")
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38201?
CVE-2025-38201 has been classified with a medium severity level due to its potential impact on system stability.
How do I fix CVE-2025-38201?
To fix CVE-2025-38201, update to the latest version of the Linux kernel that resolves this vulnerability.
What products are affected by CVE-2025-38201?
CVE-2025-38201 affects multiple versions of the Linux kernel.
What are the potential consequences of CVE-2025-38201?
The potential consequences of CVE-2025-38201 include increased risk of system instability and possible exploitation that could lead to denial of service.
Who reported CVE-2025-38201?
The CVE-2025-38201 vulnerability was reported as part of routine kernel vulnerability assessments conducted by the Linux community.