Buffer Overflow in Linux Kernel's Netfilter Component

CVE-2025-38162

What is CVE-2025-38162?

A vulnerability has been identified in the Linux kernel's Netfilter component, which can lead to a buffer overflow during lookup table allocation. It occurs when calculating the size of the lookup table, specifically when the multiplication involved can exceed predefined limits. Proper checks, such as check_mul_overflow() and check_add_overflow(), have now been implemented to ensure that these multiplications and additions do not result in overflow. Additionally, the allocation process has been standardized by replacing GFP_KERNEL with GFP_KERNEL_ACCOUNT, enhancing the consistency of the resizing function in pipapo.

References