CVE-2025-21648

EUVD-2025-2597

19.01.2025, 11:15

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: clamp maximum hashtable size to INT_MAX

Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it
is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when
resizing hashtable because __GFP_NOWARN is unset. See:

0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")

Note: hashtable resize is only possible from init_netns.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.5 MEDIUM	LOCAL	LOW	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 9%

Affected Products (NVD)

Vendor	Product	Version
linux	linux_kernel	4.7.1 ≤ 𝑥 < 5.10.234
linux	linux_kernel	5.11 ≤ 𝑥 < 5.15.177
linux	linux_kernel	5.16 ≤ 𝑥 < 6.1.125
linux	linux_kernel	6.2 ≤ 𝑥 < 6.6.72
linux	linux_kernel	6.7 ≤ 𝑥 < 6.12.10
linux	linux_kernel	4.7
linux	linux_kernel	6.13:rc1
linux	linux_kernel	6.13:rc2
linux	linux_kernel	6.13:rc3
linux	linux_kernel	6.13:rc4
linux	linux_kernel	6.13:rc5
linux	linux_kernel	6.13:rc6

𝑥

= Vulnerable software versions

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
Siemens	SIMATIC S7-1500 TM MFP - GNU\/Linux subsystem	𝑥 < *	ADP

Debian Releases

Debian Product

Codename

linux

bookworm	6.1.170-3 fixed
bookworm (security)	6.1.174-1 fixed
bullseye	vulnerable
bullseye (security)	5.10.257-1 fixed
forky	7.0.9-1 fixed
sid	7.0.10-1 fixed
trixie	6.12.86-1 fixed
trixie (security)	6.12.90-2 fixed

linux-6.1

bullseye (security)

6.1.174-1~deb11u1

fixed

openSUSE / SLES Releases

openSUSE Product

Release

cluster-md-kmp-default

suse enterprise server 12 SP5

4.12.14-122.261.1

fixed

dlm-kmp-default

suse enterprise server 12 SP5

4.12.14-122.261.1

fixed

gfs2-kmp-default

suse enterprise server 12 SP5

4.12.14-122.261.1

fixed

kernel-64kb

suse enterprise desktop 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

kernel-azure

suse enterprise sap 15 SP6	6.4.0-150600.8.40.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.20.3.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.8.40.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.20.3.1 fixed

kernel-default

suse enterprise desktop 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

kernel-default-base

suse enterprise desktop 15 SP6	6.4.0-150600.23.53.1.150600.12.24.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1.150700.17.2.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.53.1.150600.12.24.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1.150700.17.2.1 fixed
suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.53.1.150600.12.24.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1.150700.17.2.1 fixed

kernel-default-man

suse enterprise server 12 SP5

4.12.14-122.261.1

fixed

kernel-docs

suse enterprise desktop 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

kernel-macros

suse enterprise desktop 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

kernel-obs-build

suse enterprise desktop 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

kernel-source

suse enterprise desktop 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

kernel-source-azure

suse enterprise sap 15 SP6	6.4.0-150600.8.40.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.20.3.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.8.40.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.20.3.1 fixed

kernel-syms

suse enterprise desktop 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 12 SP5	4.12.14-122.261.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

kernel-syms-azure

suse enterprise sap 15 SP6	6.4.0-150600.8.40.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.20.3.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.8.40.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.20.3.1 fixed

kernel-zfcpdump

suse enterprise desktop 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise desktop 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise sap 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise sap 15 SP7	6.4.0-150700.53.3.1 fixed
suse enterprise server 15 SP6	6.4.0-150600.23.53.1 fixed
suse enterprise server 15 SP7	6.4.0-150700.53.3.1 fixed

ocfs2-kmp-default

suse enterprise server 12 SP5

4.12.14-122.261.1

fixed

Red Hat Enterprise Linux Releases

Red Hat Product

Release

kernel

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-debug

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-debug-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-debug-devel

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-debug-devel-matched

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-debug-modules

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-debug-modules-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-debug-modules-extra

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-devel

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-devel-matched

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-modules

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-modules-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-64k-modules-extra

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-abi-stablelists

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-debug

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-debug-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-debug-devel

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-debug-devel-matched

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-debug-modules

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-debug-modules-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-debug-modules-extra

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-debug-uki-virt

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-devel

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-devel-matched

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-doc

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-modules

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-modules-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-modules-extra

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-64k

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-64k-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-64k-debug

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-64k-debug-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-64k-debug-devel

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-64k-debug-modules

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-64k-debug-modules-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-64k-debug-modules-extra

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-64k-devel

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-64k-modules

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-64k-modules-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-64k-modules-extra

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-debug

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-debug-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-debug-devel

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-debug-modules

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-debug-modules-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-debug-modules-extra

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-devel

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-modules

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-modules-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-rt-modules-extra

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-tools

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-tools-libs

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-tools-libs-devel

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-uki-virt

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-uki-virt-addons

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-zfcpdump

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-zfcpdump-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-zfcpdump-devel

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-zfcpdump-devel-matched

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-zfcpdump-modules

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-zfcpdump-modules-core

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

kernel-zfcpdump-modules-extra

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

libperf

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

perf

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

python3-perf

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

rtla

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

RHEL 9

0:5.14.0-611.5.1.el9_7

fixed

References

https://git.kernel.org/stable/c/5552b4fd44be3393b930434a7845d8d95a2a3c33

https://git.kernel.org/stable/c/a965f7f0ea3ae61b9165bed619d5d6da02c75f80

https://git.kernel.org/stable/c/b1b2353d768f1b80cd7fe045a70adee576b9b338

https://git.kernel.org/stable/c/b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13

https://git.kernel.org/stable/c/d5807dd1328bbc86e059c5de80d1bbee9d58ca3d

https://git.kernel.org/stable/c/f559357d035877b9d0dcd273e0ff83e18e1d46aa

https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html

https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

https://cert-portal.siemens.com/productcert/html/ssa-265688.html