CVE-2025-38732: netfilter: nf_reject: don't leak dst refcount for loopback packets
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfreject: don't leak dst refcount for loopback packets
recent patches to add a WARN() when replacing skb dst entry found an old bug:
WARNING: include/linux/skbuff.h:1165 skbdstcheckunset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skbdstset include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nfrejectfillskbdst+0x2a4/0x330 net/ipv4/netfilter/nfrejectipv4.c:234 [..] Call Trace: nfsendunreach+0x17b/0x6e0 net/ipv4/netfilter/nfrejectipv4.c:325 nftrejectineteval+0x4bc/0x690 net/netfilter/nftrejectinet.c:27 exprcallopseval net/netfilter/nftablescore.c:237 [inline] ..
This is because blamed commit forgot about loopback packets. Such packets already have a dstentry attached, even at PREROUTING stage.
Instead of checking hook just check if the skb already has a route attached to it.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38732?
CVE-2025-38732 has been classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-38732?
To fix CVE-2025-38732, you should update your Linux kernel to the latest version where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2025-38732?
CVE-2025-38732 affects multiple versions of the Linux kernel prior to the release that includes the patch.
What type of vulnerability is CVE-2025-38732?
CVE-2025-38732 is a bug related to network filtering in the Linux kernel's netfilter subsystem.
Can CVE-2025-38732 be exploited remotely?
While CVE-2025-38732 primarily involves local processes, the implications of the vulnerability could potentially lead to exploitation under specific conditions.