CVE-2025-40206
BaseFortify
Publication date: 2025-11-12
Last updated on: 2025-11-14
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by observing kernel crash logs indicating infinite recursive calls related to synproxy stateful objects in the OUTPUT hook. Specifically, kernel logs may show a stack guard page hit with call traces involving synproxy_send_tcp_ipv6 and nft_synproxy_do_eval functions. Additionally, attempting to apply nft rules referencing synproxy objects in the OUTPUT hook will produce an error: 'synproxy_crash.nft: Error: Could not process rule: Operation not supported'.
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's netfilter nft_objref component occurs when a synproxy stateful object is referenced from the OUTPUT hook, causing an infinite recursive call that leads to a kernel crash. The issue arises because the nft_objref and objrefmap expressions were not properly validated, allowing this problematic reference. The fix involves implementing validation functions for these expressions, specifically for the NFT_OBJECT_SYNPROXY type, which prevents the crash by disallowing unsupported operations referencing synproxy objects in the OUTPUT hook.
How can this vulnerability impact me? :
This vulnerability can cause the Linux kernel to crash due to infinite recursion when a synproxy object is referenced from the OUTPUT hook in netfilter rules. Such a kernel crash can lead to system instability, downtime, and potential loss of data or service availability, impacting systems that use nftables with synproxy objects in their firewall or network filtering configurations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability immediately, avoid referencing synproxy stateful objects from the OUTPUT hook in nftables rules. Ensure that nft rules do not include synproxy objects in the OUTPUT chain to prevent kernel crashes. Applying kernel updates that include the fix for validating objref and objrefmap expressions related to synproxy objects is also recommended once available.