Reference Count Leak in Linux Kernel Netfilter Component

CVE-2025-38721

What is CVE-2025-38721?

A reference count leak exists in the netfilter component of the Linux kernel due to improper handling in the ctnetlink_dump_table function. This vulnerability can lead to conntrack objects not being properly released, potentially causing blocking issues during network namespace dismantling or when unloading the conntrack module. The issue typically arises when a specific condition is met, resulting in an unwanted increase in reference count, which can prevent system resources from being freed. Under certain circumstances, this leak may manifest during self-testing procedures, particularly when executing conntrack_resize.sh in a loop. A patch exists that aims to rectify this issue by eliminating unnecessary reference counting and instead utilizing a cookie-based approach to manage tracking state.

References