CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftables: reject duplicate device on updates
A chain/flowtable update with duplicated devices in the same batch is possible. Unfortunately, netdev event path only removes the first device that is found, leaving unregistered the hook of the duplicated device.
Check if a duplicated device exists in the transaction batch, bail out with EEXIST in such case.
WARNING is hit when unregistering the hook:
[49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nfhookentryhead+0xaa/0x150 [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S 6.16.0+ #170 PREEMPT(full) [...] [49042.221382] RIP: 0010:nfhookentryhead+0xaa/0x150
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.117.1-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 6.16.0+ #170 PREEMPT(full)Patch netfilter: nf_tables: reject duplicate device on updates - Configuration
Before applying a chain/flowtable update, check whether a duplicated device exists in the transaction batch; if so, bail out to avoid the WARNING caused by unregistering the hook when only the first duplicated device is removed.
netdev event path / netfilter (nf_tables) Duplicate device handling during transaction batch updates = abort update when duplicated device exists in the transaction batch (bail out)
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38678?
CVE-2025-38678 has been classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38678?
To fix CVE-2025-38678, update your Linux kernel to the latest version recommended by your distribution.
What are the potential impacts of CVE-2025-38678?
The potential impacts of CVE-2025-38678 include network instability and the possibility of incorrect device management during updates.
Which Linux kernel versions are affected by CVE-2025-38678?
CVE-2025-38678 affects Linux kernel versions starting from 6.16.0 and onwards.
Is CVE-2025-38678 actively being exploited in the wild?
As of now, there are no confirmed reports of CVE-2025-38678 being actively exploited in the wild.