CVE-2025-21648
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In the Linux kernel, a vulnerability in the netfilter conntrack module allows the hashtable size to exceed INT_MAX during resize, triggering a WARN_ON_ONCE in __kvmalloc_node_noprof() due to missing __GFP_NOWARN flag. This issue is limited to the init_netns namespace.
Risk Assessment
The risk involves potential system disruption by triggering a kernel warning, which could lead to instability or a Denial of Service (DoS) attack in high-traffic network environments.
Recommendation
Immediately update the Linux kernel to a version that includes the fix clamping the maximum hashtable size to INT_MAX. As a workaround, restrict hashtable resize capabilities by configuring network parameters appropriately.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See: 0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls") Note: hashtable resize is only possible from init_netns.