cve/2025/CVE-2025-21648.md

CVE-2025-21648

Description

In the Linux kernel, the following vulnerability has been resolved:netfilter: conntrack: clamp maximum hashtable size to INT_MAXUse INT_MAX as maximum size for the conntrack hashtable. Otherwise, itis possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() whenresizing hashtable because __GFP_NOWARN is unset. See: 0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")Note: hashtable resize is only possible from init_netns.

POC

Reference

No PoCs from references.

Github

• https://github.com/ARPSyndicate/cve-scores
• https://github.com/fkie-cad/nvd-json-data-feeds
• https://github.com/oogasawa/Utility-security
• https://github.com/w4zu/Debian_security