cve/published/2025/CVE-2025-21648.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2025-21648: netfilter: conntrack: clamp maximum hashtable size to INT_MAX

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: clamp maximum hashtable size to INT_MAX

Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it
is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when
resizing hashtable because __GFP_NOWARN is unset. See:

  0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")

Note: hashtable resize is only possible from init_netns.

The Linux kernel CVE team has assigned CVE-2025-21648 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.7 with commit 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 and fixed in 5.10.234 with commit a965f7f0ea3ae61b9165bed619d5d6da02c75f80
	Issue introduced in 4.7 with commit 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 and fixed in 5.15.177 with commit b1b2353d768f1b80cd7fe045a70adee576b9b338
	Issue introduced in 4.7 with commit 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 and fixed in 6.1.125 with commit 5552b4fd44be3393b930434a7845d8d95a2a3c33
	Issue introduced in 4.7 with commit 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 and fixed in 6.6.72 with commit d5807dd1328bbc86e059c5de80d1bbee9d58ca3d
	Issue introduced in 4.7 with commit 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 and fixed in 6.12.10 with commit f559357d035877b9d0dcd273e0ff83e18e1d46aa
	Issue introduced in 4.7 with commit 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 and fixed in 6.13 with commit b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21648
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/nf_conntrack_core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/a965f7f0ea3ae61b9165bed619d5d6da02c75f80
	https://git.kernel.org/stable/c/b1b2353d768f1b80cd7fe045a70adee576b9b338
	https://git.kernel.org/stable/c/5552b4fd44be3393b930434a7845d8d95a2a3c33
	https://git.kernel.org/stable/c/d5807dd1328bbc86e059c5de80d1bbee9d58ca3d
	https://git.kernel.org/stable/c/f559357d035877b9d0dcd273e0ff83e18e1d46aa
	https://git.kernel.org/stable/c/b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13