Message-ID: <2025090400-CVE-2025-38721-e31a@gregkh>
Date: Thu,  4 Sep 2025 17:33:26 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38721: netfilter: ctnetlink: fix refcount leak on table dump

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ctnetlink: fix refcount leak on table dump

There is a reference count leak in ctnetlink_dump_table():
      if (res < 0) {
                nf_conntrack_get(&ct->ct_general); // HERE
                cb->args[1] = (unsigned long)ct;
                ...

While its very unlikely, its possible that ct == last.
If this happens, then the refcount of ct was already incremented.
This 2nd increment is never undone.

This prevents the conntrack object from being released, which in turn
keeps prevents cnet->count from dropping back to 0.

This will then block the netns dismantle (or conntrack rmmod) as
nf_conntrack_cleanup_net_list() will wait forever.

This can be reproduced by running conntrack_resize.sh selftest in a loop.
It takes ~20 minutes for me on a preemptible kernel on average before
I see a runaway kworker spinning in nf_conntrack_cleanup_net_list.

One fix would to change this to:
        if (res < 0) {
		if (ct != last)
	                nf_conntrack_get(&ct->ct_general);

But this reference counting isn't needed in the first place.
We can just store a cookie value instead.

A followup patch will do the same for ctnetlink_exp_dump_table,
it looks to me as if this has the same problem and like
ctnetlink_dump_table, we only need a 'skip hint', not the actual
object so we can apply the same cookie strategy there as well.

The Linux kernel CVE team has assigned CVE-2025-38721 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.18 with commit d205dc40798d97d63ad348bfaf7394f445d152d4 and fixed in 5.4.297 with commit 586892e341fbf698e7cbaca293e1353957db725a
	Issue introduced in 2.6.18 with commit d205dc40798d97d63ad348bfaf7394f445d152d4 and fixed in 5.10.241 with commit 962518c6ca9f9a13df099cafa429f72f68ad61f0
	Issue introduced in 2.6.18 with commit d205dc40798d97d63ad348bfaf7394f445d152d4 and fixed in 5.15.190 with commit 19b909a4b1452fb97e477d2f08b97f8d04095619
	Issue introduced in 2.6.18 with commit d205dc40798d97d63ad348bfaf7394f445d152d4 and fixed in 6.1.149 with commit 41462f4cfc583513833f87f9ee55d12da651a7e3
	Issue introduced in 2.6.18 with commit d205dc40798d97d63ad348bfaf7394f445d152d4 and fixed in 6.6.103 with commit 30cf811058552b8cd0e98dff677ef3f89d6d34ce
	Issue introduced in 2.6.18 with commit d205dc40798d97d63ad348bfaf7394f445d152d4 and fixed in 6.12.43 with commit a2cb4df7872de069f809de2f076ec8e54d649fe3
	Issue introduced in 2.6.18 with commit d205dc40798d97d63ad348bfaf7394f445d152d4 and fixed in 6.15.11 with commit e14f72aa66c029db106921d621edcedef68e065b
	Issue introduced in 2.6.18 with commit d205dc40798d97d63ad348bfaf7394f445d152d4 and fixed in 6.16.2 with commit a62d6aa3f31f216b637a4c71b7a8bfc7c57f049b
	Issue introduced in 2.6.18 with commit d205dc40798d97d63ad348bfaf7394f445d152d4 and fixed in 6.17-rc2 with commit de788b2e6227462b6dcd0e07474e72c089008f74

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38721
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/nf_conntrack_netlink.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/586892e341fbf698e7cbaca293e1353957db725a
	https://git.kernel.org/stable/c/962518c6ca9f9a13df099cafa429f72f68ad61f0
	https://git.kernel.org/stable/c/19b909a4b1452fb97e477d2f08b97f8d04095619
	https://git.kernel.org/stable/c/41462f4cfc583513833f87f9ee55d12da651a7e3
	https://git.kernel.org/stable/c/30cf811058552b8cd0e98dff677ef3f89d6d34ce
	https://git.kernel.org/stable/c/a2cb4df7872de069f809de2f076ec8e54d649fe3
	https://git.kernel.org/stable/c/e14f72aa66c029db106921d621edcedef68e065b
	https://git.kernel.org/stable/c/a62d6aa3f31f216b637a4c71b7a8bfc7c57f049b
	https://git.kernel.org/stable/c/de788b2e6227462b6dcd0e07474e72c089008f74

Powered by blists - more mailing lists