Critical Vulnerability in Linux Kernel: Unregistered Hook Issue in Netfilter
Summary
DEBIAN-CVE-2025-22064: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't unregister hook when table is dormant When nf_tables_updchain encounters an error, hook registration needs to be rolled back... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The kernel is modular, allowing for the addition of various features, including networking capabilities through netfilter. This specific vulnerability affects the netfilter subsystem, which is crucial for packet filtering, network address translation, and other networking functions.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the netfilter component related to the nf_tables subsystem. The issue arises when the nf_tables_updchain function encounters an error during the registration of a hook. If the table is flagged as dormant (inactive), the hook should not be unregistered. However, the current implementation incorrectly attempts to roll back the registration, which can lead to undefined behavior and potential security risks. This flaw could allow an attacker to exploit the system by manipulating network traffic or causing instability in the kernel.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The vulnerability identified in the Linux kernel's netfilter subsystem poses significant risks to system integrity and security. Users are strongly advised to update their kernel to the patched version 6.12.25-1 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves incorrect handling of hook registration in the netfilter subsystem of the Linux kernel, which can lead to security risks.
You can use Vulert to monitor and alert for open-source vulnerabilities. By uploading your manifest file, you can check if your application is affected by this vulnerability.
Exploitation of this vulnerability could allow attackers to manipulate network traffic or cause system instability, leading to potential data breaches or service disruptions.
Yes, a patch has been released in version 6.12.25-1 of the Linux kernel for Debian 13 and 14.
You can use Vulert, which provides real-time monitoring and alerts for open-source vulnerabilities without requiring code access or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
