Reference Count Leak in Linux Kernel's Netfilter Module
Summary
CVE-2025-38721: In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources, system calls, and process scheduling. The netfilter module is responsible for packet filtering, network address translation, and connection tracking. This vulnerability affects the conntrack component of netfilter, which is crucial for managing network connections and ensuring proper resource allocation.
Vulnerability Detail
In the Linux kernel, a reference count leak exists in the ctnetlink_dump_table function. When an error occurs during the table dump process, the reference count of a connection tracking object is incremented without being decremented if the object is already the last one. This leads to a situation where the conntrack object cannot be released, causing the net namespace to block and preventing the cleanup of connection tracking resources. The issue can be reproduced by running the conntrack_resize.sh selftest in a loop, which may lead to a runaway kworker process spinning indefinitely in the cleanup function.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
A potential workaround is to modify the ctnetlink_dump_table function to include a check for the last connection tracking object before incrementing the reference count. The modified code would look like this: if (res < 0) { if (ct != last)
nf_conntrack_get(&ct->ct_general);
} This change prevents unnecessary reference count increments.
Conclusion
The CVE-2025-38721 vulnerability in the Linux kernel's netfilter module presents a significant risk due to a reference count leak that can lead to resource management issues. Users are encouraged to update their systems to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing open-source vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to resource leaks, preventing the cleanup of connection tracking objects, which may block network namespace dismantling and cause system instability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
Yes, patched versions of the Linux kernel are available. Users should update to version 6.12.43-1 for Debian 13 and 6.16.3-1 for Debian 14.
As a temporary measure, consider implementing the suggested workaround in the code to prevent the reference count leak until you can apply the official patch.
Detailed information can be found in the CVE report for CVE-2025-38721, which outlines the vulnerability and its implications.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
