Riskcovery

CVE-2025-21648

netfilter: conntrack: clamp maximum hashtable size to INT_MAX

State
Published
Severity
Not scored
Published
Jan 19, 2025
Updated
Oct 15, 2026
Reserved
Dec 29, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: clamp maximum hashtable size to INT_MAX

Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See:

0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")

Note: hashtable resize is only possible from init_netns.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 to before a965f7f0ea3ae61b9165bed619d5d6da02c75f80Affected
  • 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 to before b1b2353d768f1b80cd7fe045a70adee576b9b338Affected
  • 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 to before 5552b4fd44be3393b930434a7845d8d95a2a3c33Affected
  • 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 to before d5807dd1328bbc86e059c5de80d1bbee9d58ca3dAffected
  • 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 to before f559357d035877b9d0dcd273e0ff83e18e1d46aaAffected
  • 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 to before b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13Affected
LinuxLinux
  • 4.7Affected
  • before 4.7Not affected
  • 5.10.234 through 5.10.*Not affected
  • 5.15.177 through 5.15.*Not affected
  • 6.1.125 through 6.1.*Not affected
  • 6.6.72 through 6.6.*Not affected
  • 6.12.10 through 6.12.*Not affected
  • 6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.