Riskcovery

CVE-2025-38201

netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX

State
Published
Severity
Not scored
Published
Jul 4, 2025
Updated
Oct 15, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX

Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset.

Similar to:

b541ba7d1f5a ("netfilter: conntrack: clamp maximum hashtable size to INT_MAX")

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 3c4287f62044a90e73a561aa05fc46e62da173da to before 1fe27f97944017a9d3c5af4d6d95282bff0f1147Affected
  • 3c4287f62044a90e73a561aa05fc46e62da173da to before 4abccfb61f422300be014b8e734c63344306f009Affected
  • 3c4287f62044a90e73a561aa05fc46e62da173da to before 80417057ac60dd80f4816eb426e4e4a5bf696534Affected
  • 3c4287f62044a90e73a561aa05fc46e62da173da to before df524a68d9021c1401965d610bb6e42ee5d9611eAffected
  • 3c4287f62044a90e73a561aa05fc46e62da173da to before 0ab3de047808f375a36cd345225572eb3366f3c6Affected
  • 3c4287f62044a90e73a561aa05fc46e62da173da to before d2768016f091f8a5264076b433fd7c3fabb6eb97Affected
  • 3c4287f62044a90e73a561aa05fc46e62da173da to before b85e3367a5716ed3662a4fe266525190d2af76dfAffected
LinuxLinux
  • 5.6Affected
  • before 5.6Not affected
  • 5.10.250 through 5.10.*Not affected
  • 5.15.200 through 5.15.*Not affected
  • 6.1.163 through 6.1.*Not affected
  • 6.6.124 through 6.6.*Not affected
  • 6.12.35 through 6.12.*Not affected
  • 6.15.4 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.