NetSight
IP …
medium5.5

CVE-2025-21648

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size f…

Impact

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See: 0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls") Note: hashtable resize is only possible from init_netns.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 4.7.1 before 5.10.234
from 5.11 before 5.15.177
from 5.16 before 6.1.125
from 6.2 before 6.6.72
from 6.7 before 6.12.10
Version 4.7

References