VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Jan 19, 2025· Updated May 12, 2026

CVE-2025-21648

CVE-2025-21648

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: clamp maximum hashtable size to INT_MAX

Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See:

0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")

Note: hashtable resize is only possible from init_netns.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel netfilter conntrack module, a missing clamp of the hashtable size to INT_MAX can trigger a WARN_ON_ONCE during resize.

The vulnerability in the Linux kernel's netfilter conntrack module arises because the hashtable resize function does not limit the requested size to INT_MAX. This can cause a call to __kvmalloc_node_noprof without the __GFP_NOWARN flag, leading to a WARN_ON_ONCE when the allocation size overflows.

Exploitation is possible only from the initial network namespace (init_netns), as hashtable resize is restricted to that context. An attacker with sufficient privileges to trigger a resize could cause a kernel warning, which may result in a denial of service due to system instability or logs being flooded.

The impact is limited to a kernel warning, but repeated triggers could degrade system performance or lead to a crash. No privilege escalation is involved.

The fix clamps the maximum hashtable size to INT_MAX, preventing the overflow. Patches have been applied to the Linux kernel stable branches, and users are advised to update to the latest kernels.

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

165

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

9

News mentions

0

No linked articles in our index yet.