CVE-2025-40206

netfilter: nft_objref: validate objref and objrefmap expressions

State: Published
Severity: 7.8 High
Published: Nov 12, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_objref: validate objref and objrefmap expressions

Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls:

BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace: __find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 nft_synproxy_do_eval+0x263/0x310 nft_do_chain+0x5a8/0x5f0 [nf_tables nft_do_chain_inet+0x98/0x110 nf_hook_slow+0x43/0xc0 __ip6_local_out+0xf0/0x170 ip6_local_out+0x17/0x70 synproxy_send_tcp_ipv6+0x1a2/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 [...]

Implement objref and objrefmap expression validate functions.

Currently, only NFT_OBJECT_SYNPROXY object type requires validation. This will also handle a jump to a chain using a synproxy object from the OUTPUT hook.

Now when trying to reference a synproxy object in the OUTPUT hook, nft will produce the following error:

synproxy_crash.nft: Error: Could not process rule: Operation not supported synproxy name mysynproxy ^^^^^^^^^^^^^^^^^^^^^^^^

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ee394f96ad7517fbc0de9106dcc7ce9efb14f264 to before f31bcea12222a26d6f151df9c4a6d21f2eec1724Affected ee394f96ad7517fbc0de9106dcc7ce9efb14f264 to before 0028e0134c64d9ed21728341a74fcfc59cd0f944Affected ee394f96ad7517fbc0de9106dcc7ce9efb14f264 to before 7ea55a44493a5a36c3b3293b88bbe4841f9dbaf0Affected ee394f96ad7517fbc0de9106dcc7ce9efb14f264 to before 4c1cf72ec10be5a9ad264650cadffa1fbce6fabdAffected ee394f96ad7517fbc0de9106dcc7ce9efb14f264 to before f359b809d54c6e3dd1d039b97e0b68390b0e53e4Affected
LinuxLinux	5.4Affected before 5.4Not affected 6.1.184 through 6.1.Not affected 6.6.113 through 6.6.Not affected 6.12.54 through 6.12.Not affected 6.17.4 through 6.17.Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

ee394f96ad7517fbc0de9106dcc7ce9efb14f264 to before f31bcea12222a26d6f151df9c4a6d21f2eec1724Affected
ee394f96ad7517fbc0de9106dcc7ce9efb14f264 to before 0028e0134c64d9ed21728341a74fcfc59cd0f944Affected
ee394f96ad7517fbc0de9106dcc7ce9efb14f264 to before 7ea55a44493a5a36c3b3293b88bbe4841f9dbaf0Affected
ee394f96ad7517fbc0de9106dcc7ce9efb14f264 to before 4c1cf72ec10be5a9ad264650cadffa1fbce6fabdAffected
ee394f96ad7517fbc0de9106dcc7ce9efb14f264 to before f359b809d54c6e3dd1d039b97e0b68390b0e53e4Affected

LinuxLinux

5.4Affected
before 5.4Not affected
6.1.184 through 6.1.*Not affected
6.6.113 through 6.6.*Not affected
6.12.54 through 6.12.*Not affected
6.17.4 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.