CVE-2025-39764: netfilter: ctnetlink: remove refcounting in expectation dumpers
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ctnetlink: remove refcounting in expectation dumpers
Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use that as the skip hint for dump resumption.
AFAICS this has the same issue as the one resolved in the conntrack dumper, when we do if (!refcountincnotzero(&exp->use))
to increment the refcount, there is a chance that exp == last, which causes a double-increment of the refcount and subsequent memory leak.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39764?
The severity of CVE-2025-39764 is labeled as moderate due to potential impact on kernel security.
How do I fix CVE-2025-39764?
To fix CVE-2025-39764, upgrade to the latest version of the Linux kernel that contains the patch for this vulnerability.
What are the affected systems for CVE-2025-39764?
CVE-2025-39764 affects various distributions of the Linux kernel.
What does CVE-2025-39764 involve?
CVE-2025-39764 involves the removal of refcounting in expectation dumpers within the netfilter subsystem of the Linux kernel.
Is CVE-2025-39764 easily exploitable?
CVE-2025-39764 is not widely exploitable in common configurations, but specific conditions could lead to risks.