Netfilter Vulnerability in Linux Kernel Causes Crash During Conntrack Entry Removal

CVE-2025-38472

What is CVE-2025-38472?

This vulnerability in the Linux kernel's netfilter subsystem can lead to a crash when removing uninitialized entries from the conntrack hash bucket list. The issue arises due to a race condition during the deletion and initialization process of conntrack entries. Specifically, if multiple CPUs access and modify a conntrack entry simultaneously, it can result in corrupted internal pointers, leading to a crash when the system attempts to access or delete these faulty entries. The solution involves rearranging how and when the 'CONFIRMED' state is set to ensure that entries are properly managed without risking system stability.

References