CVE-2025-39764
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
11/09/2025
Last modified:
25/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
netfilter: ctnetlink: remove refcounting in expectation dumpers<br />
<br />
Same pattern as previous patch: do not keep the expectation object<br />
alive via refcount, only store a cookie value and then use that<br />
as the skip hint for dump resumption.<br />
<br />
AFAICS this has the same issue as the one resolved in the conntrack<br />
dumper, when we do<br />
if (!refcount_inc_not_zero(&exp->use))<br />
<br />
to increment the refcount, there is a chance that exp == last, which<br />
causes a double-increment of the refcount and subsequent memory leak.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 2.6.23 (including) | 6.16.2 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page