CVE-2025-39764
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
In the Linux kernel netfilter subsystem (ctnetlink), reference counting was removed from expectation dumpers. The fix prevents a double refcount increment and memory leak that could occur during dump resumption.
Risk Assessment
The vulnerability may cause kernel memory leaks, potentially leading to system performance degradation or crash over time.
Recommendation
Immediately update the Linux kernel to a version containing this fix (commit in the netfilter branch).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: remove refcounting in expectation dumpers Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use that as the skip hint for dump resumption. AFAICS this has the same issue as the one resolved in the conntrack dumper, when we do if (!refcount_inc_not_zero(&exp->use)) to increment the refcount, there is a chance that exp == last, which causes a double-increment of the refcount and subsequent memory leak.