CVE-2025-21959

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()

Since commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage

collection confirm race"), `cpu` and `jiffies32` were introduced to

the struct nf_conncount_tuple.

The commit made nf_conncount_add() initialize `conn->cpu` and

`conn->jiffies32` when allocating the struct.

In contrast, count_tree() was not changed to initialize them.

By commit 34848d5c896e ("netfilter: nf_conncount: Split insert and

traversal"), count_tree() was split and the relevant allocation

code now resides in insert_tree().

Initialize `conn->cpu` and `conn->jiffies32` in insert_tree().

BUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline]

BUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143

find_or_evict net/netfilter/nf_conncount.c:117 [inline]

__nf_conncount_add+0xd9c/0x2850 net/netfilte

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References