Critical Vulnerability in Linux Kernel: Netfilter Maximum Map Bucket Size Clamping Issue
Summary
DEBIAN-CVE-2025-38201: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX Otherwise, it is possible to hit WARN_ON_ONCE in kvmalloc_node_noprof() when resizin... Affects linux versions < 6.12.35-1. Fixed in 6.12.35-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It is known for its performance, scalability, and security features. However, vulnerabilities can arise, impacting its reliability and security. This specific vulnerability pertains to the netfilter subsystem, which is responsible for packet filtering, network address translation, and connection tracking.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the netfilter component, specifically related to the nft_set_pipapo function. This issue allows for the maximum map bucket size to exceed the integer limit (INT_MAX), potentially leading to a crash or unexpected behavior when resizing the hashtable. The root cause is linked to the unset __GFP_NOWARN flag in the __kvmalloc_node_noprof function, which can trigger a WARN_ON_ONCE condition. This vulnerability can lead to denial of service or system instability, making it critical to address.
How To Fix
Minimum fixed version
6.12.35-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch by updating the package as described above.
Conclusion
The vulnerability identified in the Linux kernel's netfilter subsystem poses significant risks, including potential system crashes and instability. It is crucial to update to the patched version (6.12.35-1) to mitigate these risks. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to system crashes or instability due to improper handling of the maximum map bucket size in the netfilter subsystem.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Yes, a patch is available in the form of the Linux kernel version 6.12.35-1. Updating to this version will resolve the vulnerability.
While there are no specific workarounds, it is advisable to monitor your system closely for any unusual behavior until you can apply the patch.
Detailed information can be found in the Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38201.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
