CVE-2025-38472

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: fix crash due to removal of uninitialised entry

A crash in conntrack was reported while trying to unlink the conntrack

entry from the hash bucket list:

[exception RIP: __nf_ct_delete_from_lists+172]

[..]

#7 [ff539b5a2b043aa0] nf_ct_delete at ffffffffc124d421 [nf_conntrack]

#8 [ff539b5a2b043ad0] nf_ct_gc_expired at ffffffffc124d999 [nf_conntrack]

#9 [ff539b5a2b043ae0] __nf_conntrack_find_get at ffffffffc124efbc [nf_conntrack]

[..]

The nf_conn struct is marked as allocated from slab but appears to be in

a partially initialised state:

ct hlist pointer is garbage; looks like the ct hash value

(hence crash).

ct->status is equal to IPS_CONFIRMED|IPS_DYING, which is expected

ct->timeout is 30000 (=30s), which is unexpected.

Everything else looks like normal udp conntrack entry. If we ignore

ct->status and pretend its 0, the entry matches those that are newly

allocated but not

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References