CVE-2025-38721

Q: What is the severity of CVE-2025-38721?

CVE-2025-38721 has a CVSS score of 5.5 (MEDIUM). A reference count leak in the Linux kernel's netfilter ctnetlink component prevents proper cleanup of connection tracking objects. This can cause kernel memory exhaustion and potentially block network namespace dismantling or module unloading. Systems running vulnerable Linux kernel versions with netfilter enabled are affected.

5.5 MEDIUM

Denial of Service

📋 TL;DR

A reference count leak in the Linux kernel's netfilter ctnetlink component prevents proper cleanup of connection tracking objects. This can cause kernel memory exhaustion and potentially block network namespace dismantling or module unloading. Systems running vulnerable Linux kernel versions with netfilter enabled are affected.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific versions containing the vulnerable code (check git commits for exact ranges)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires netfilter connection tracking to be enabled (common in most Linux firewall configurations).

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory exhaustion leading to system instability, inability to unload netfilter modules, and potential denial of service through resource starvation.

🟠

Likely Case

Gradual memory leak that may cause performance degradation over time, particularly on systems with high connection tracking activity.

🟢

If Mitigated

Minimal impact if systems are regularly rebooted or have memory monitoring in place to detect leaks.

🌐 Internet-Facing: MEDIUM - Internet-facing systems with netfilter enabled could be targeted to trigger the leak through connection tracking operations.

🏢 Internal Only: LOW - Internal systems with limited connection tracking activity would experience slower leak progression.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering specific netfilter operations; the vulnerability was discovered through selftest loops rather than active exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing fixes from git commits: 19b909a4b1452fb97e477d2f08b97f8d04095619, 30cf811058552b8cd0e98dff677ef3f89d6d34ce, 41462f4cfc583513833f87f9ee55d12da651a7e3, 586892e341fbf698e7cbaca293e1353957db725a, 962518c6ca9f9a13df099cafa429f72f68ad61f0

Vendor Advisory: https://git.kernel.org/stable/c/19b909a4b1452fb97e477d2f08b97f8d04095619

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Check your distribution's security advisories for backported patches. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable connection tracking if not needed

Linux

If connection tracking is not required for your use case, disabling it eliminates the vulnerability.

modprobe -r nf_conntrack
echo 'blacklist nf_conntrack' > /etc/modprobe.d/blacklist-conntrack.conf

🧯 If You Can't Patch

Implement regular system reboots to clear accumulated memory leaks
Monitor kernel memory usage and connection tracking table size for abnormal growth

🔍 How to Verify

Check if Vulnerable:

Check kernel version and verify if it contains the vulnerable code by examining netfilter ctnetlink source or checking distribution security advisories.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits or check that connection tracking objects are properly released during netns dismantle operations.

📡 Detection & Monitoring

Log Indicators:

Kernel oom-killer messages
High memory usage in kernel space
nf_conntrack table size growing abnormally

Network Indicators:

Degradation in network performance due to kernel resource exhaustion

SIEM Query:

kernel: "nf_conntrack_cleanup_net_list" OR "conntrack" AND ("memory" OR "oom")

📊 Metadata

CVE ID: CVE-2025-38721

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.01% exploit probability (2.3th percentile)

Published: September 4, 2025

Last Updated: January 9, 2026

🔗 References

https://git.kernel.org/stable/c/19b909a4b1452fb97e477d2f08b97f8d04095619 Patch
https://git.kernel.org/stable/c/30cf811058552b8cd0e98dff677ef3f89d6d34ce Patch
https://git.kernel.org/stable/c/41462f4cfc583513833f87f9ee55d12da651a7e3 Patch
https://git.kernel.org/stable/c/586892e341fbf698e7cbaca293e1353957db725a Patch
https://git.kernel.org/stable/c/962518c6ca9f9a13df099cafa429f72f68ad61f0 Patch
https://git.kernel.org/stable/c/a2cb4df7872de069f809de2f076ec8e54d649fe3 Patch
https://git.kernel.org/stable/c/a62d6aa3f31f216b637a4c71b7a8bfc7c57f049b Patch
https://git.kernel.org/stable/c/de788b2e6227462b6dcd0e07474e72c089008f74 Patch
https://git.kernel.org/stable/c/e14f72aa66c029db106921d621edcedef68e065b Patch
https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory,Mailing List
https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory,Mailing List

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable connection tracking if not needed

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export