CVE-2025-38732

Vulnerability

In the Linux kernel, a vulnerability in netfilter's nf_reject module causes a dst refcount leak for loopback packets. The issue arises because loopback packets already have a dst_entry attached at the PRE_ROUTING stage, but the code incorrectly assumes they do not. This leads to a warning when replacing the skb dst entry, as described in the kernel commit that introduced the fix [2].

Exploitation

An attacker with network access can send crafted loopback packets to trigger the bug. No authentication is required, as the vulnerability lies in the kernel's packet processing path. The attack surface is limited to scenarios where netfilter rejection rules are applied to loopback traffic.

Impact

Exploiting this vulnerability results in a kernel warning (WARN()) and a refcount leak. While the warning may be benign in some cases, the refcount leak could lead to resource exhaustion and system instability, potentially causing a denial of service (DoS) condition.

Mitigation

The Linux kernel has addressed this vulnerability in stable releases. The fix commit (82ef97abf227) [2] changes the check to verify if the skb already has a route attached, rather than relying on the hook. Users should apply the latest kernel updates. Additionally, this CVE is listed in a Siemens advisory for SIMATIC CN 4100 [1].