CVE-2025-21648

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74

Description A vulnerability in the Linux kernel has been resolved, related to the netfilter conntrack hashtable size. The issue allowed for a potential WARN ON ONCE in kvmalloc node noprof() when resizing the hashtable because GFP NOWARN was unset. The fix involves clamping the maximum hashtable size to INT MAX. Hashtable resize is only possible from init netns.

Recommendations For Linux kernel versions prior to 6.6.74, update to version 6.6.74 or later to resolve the issue. As a temporary workaround, consider restricting the resize of the conntrack hashtable to prevent potential exploitation.