CVE-2025-21648

Q: What is the severity of CVE-2025-21648?

CVE-2025-21648 has a CVSS score of 5.5 (MEDIUM). This vulnerability in the Linux kernel's netfilter conntrack module allows an attacker to trigger a kernel warning by attempting to resize the connection tracking hashtable beyond INT_MAX entries. This affects Linux systems using netfilter conntrack functionality, primarily those with custom configurations or exposed to malicious network traffic. The issue is limited to the initial network namespace (init_netns).

5.5 MEDIUM

📋 TL;DR

This vulnerability in the Linux kernel's netfilter conntrack module allows an attacker to trigger a kernel warning by attempting to resize the connection tracking hashtable beyond INT_MAX entries. This affects Linux systems using netfilter conntrack functionality, primarily those with custom configurations or exposed to malicious network traffic. The issue is limited to the initial network namespace (init_netns).

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not explicitly stated in CVE description; check kernel commit history for exact range.

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when conntrack hashtable resize is attempted in init_netns; default configurations typically not affected.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Triggering a kernel warning that could lead to system instability, denial of service, or kernel panic in sensitive environments.

🟠

Likely Case

Kernel warning messages in logs with minimal operational impact for most systems.

🟢

If Mitigated

No impact if hashtable size is properly configured or if the system is not exposed to malicious traffic.

🌐 Internet-Facing: LOW - Requires specific conditions and access to the initial network namespace.

🏢 Internal Only: LOW - Limited to systems with custom conntrack configurations or exposed to internal malicious actors.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires specific conditions: ability to trigger hashtable resize in init_netns with oversized parameters.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 5552b4fd44be3393b930434a7845d8d95a2a3c33, a965f7f0ea3ae61b9165bed619d5d6da02c75f80, b1b2353d768f1b80cd7fe045a70adee576b9b338, b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13, d5807dd1328bbc86e059c5de80d1bbee9d58ca3d

Vendor Advisory: https://git.kernel.org/stable/c/5552b4fd44be3393b930434a7845d8d95a2a3c33

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Reboot system. 3. Verify kernel version matches patched release.

🔧 Temporary Workarounds

Limit conntrack hashtable size

linux

Prevent hashtable resize beyond safe limits by configuring maximum size.

sysctl -w net.netfilter.nf_conntrack_max=INT_MAX

🧯 If You Can't Patch

Monitor system logs for kernel warnings related to conntrack or kvmalloc
Restrict network access to systems to prevent malicious traffic triggering the condition

🔍 How to Verify

Check if Vulnerable:

Check kernel version against known vulnerable ranges; examine if conntrack is configured with large hashtable sizes.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits; check that conntrack hashtable operations don't trigger warnings.

📡 Detection & Monitoring

Log Indicators:

Kernel warning messages containing 'WARN_ON_ONCE', '__kvmalloc_node_noprof', or 'conntrack'

Network Indicators:

Unusual network traffic patterns attempting to create excessive connections

SIEM Query:

source="kernel" AND ("WARN_ON_ONCE" OR "conntrack" OR "kvmalloc")

📊 Metadata

CVE ID: CVE-2025-21648

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.06% exploit probability (19.7th percentile)

Published: January 19, 2025

Last Updated: November 3, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Limit conntrack hashtable size

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export