Critical Vulnerability in Linux Kernel: Open vSwitch Conntrack Label Handling
Summary
DEBIAN-CVE-2025-21958: In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovs_ct_set_labels() is only called for confirmed conntrack entries (ct... Affects linux versions < 6.12.20-1. Fixed in 6.12.20-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and networking. The Open vSwitch (OVS) is a multilayer virtual switch designed to enable network automation while supporting standard management interfaces and protocols. This vulnerability specifically affects the conntrack label handling within OVS, which is crucial for tracking network connections.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the Open vSwitch (OVS) conntrack label handling. The issue arises when the function ovs_ct_set_labels() is called for confirmed conntrack entries that lack the labels_ext extension. This situation triggers a warning in nf_ct_ext_add() due to the attempt to allocate labels for a conntrack entry created externally. The problem has been exacerbated by a previous commit that altered the label counting mechanism, leading to potential instability and warnings in the kernel. If left unaddressed, this vulnerability could disrupt network operations and impact applications relying on OVS for connection tracking.
How To Fix
Minimum fixed version
6.12.20-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no straightforward workaround to fully resolve this issue. However, reverting the specific commit that introduced the problem can help avoid breaking existing use cases. This can be done by applying a patch that reverts the changes made in commit fcb1aa5163b1.
Conclusion
In summary, a critical vulnerability has been identified in the Linux kernel related to Open vSwitch conntrack label handling. Users are advised to update their systems to the patched version to mitigate potential risks. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves improper handling of conntrack labels in Open vSwitch, leading to warnings and potential instability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without signup.
Failure to address this vulnerability may lead to network disruptions and instability in applications relying on Open vSwitch for connection tracking.
Yes, a patched version of the Linux kernel (6.12.20-1) is available. Updating to this version will resolve the vulnerability.
Open vSwitch is a multilayer virtual switch designed to enable network automation and support standard management interfaces and protocols.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
