CVE-2025-21958

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Revert "openvswitch: switch to per-action label counting in conntrack"

Currently, ovs_ct_set_labels() is only called for confirmed conntrack

entries (ct) within ovs_ct_commit(). However, if the conntrack entry

does not have the labels_ext extension, attempting to allocate it in

ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in

nf_ct_ext_add():

WARN_ON(nf_ct_is_confirmed(ct));

This happens when the conntrack entry is created externally before OVS

increments net->ct.labels_used. The issue has become more likely since

commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting

in conntrack"), which changed to use per-action label counting and

increment net->ct.labels_used when a flow with ct action is added.

Since there’s no straightforward way to fully resolve this issue at the

moment, this reverts the commit to avoid breaking existing use cases.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References