Skip to main content

Linux Kernel CVE-2025-40206

HIGH
2025-11-12 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Denial Of Service Linux
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.5 MEDIUM

Local attacker needs CAP_NET_ADMIN to load the rule (PR:L, AV:L); impact is a kernel-stack-exhaustion crash, so A:H with no confidentiality or integrity effect.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.1 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
4.4 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Jul 30, 2026 - 08:18 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Jul 30, 2026 - 06:37 vuln.today
cvss_changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.8 (HIGH)
Patch released
Mar 28, 2026 - 19:31 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 19:21 vuln.today
CVE Published
Nov 12, 2025 - 22:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_objref: validate objref and objrefmap expressions

Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls:

BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace: __find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 nft_synproxy_do_eval+0x263/0x310 nft_do_chain+0x5a8/0x5f0 [nf_tables nft_do_chain_inet+0x98/0x110 nf_hook_slow+0x43/0xc0 __ip6_local_out+0xf0/0x170 ip6_local_out+0x17/0x70 synproxy_send_tcp_ipv6+0x1a2/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 [...]

Implement objref and objrefmap expression validate functions.

Currently, only NFT_OBJECT_SYNPROXY object type requires validation. This will also handle a jump to a chain using a synproxy object from the OUTPUT hook.

Now when trying to reference a synproxy object in the OUTPUT hook, nft will produce the following error:

synproxy_crash.nft: Error: Could not process rule: Operation not supported synproxy name mysynproxy ^^^^^^^^^^^^^^^^^^^^^^^^

AnalysisAI

Denial of service in the Linux kernel's netfilter nf_tables subsystem allows a local user with network-administration capability to crash the host by referencing an NFT_OBJECT_SYNPROXY stateful object from the OUTPUT hook, triggering unbounded recursion (synproxy sends a SYN-ACK that re-enters the OUTPUT chain, which re-invokes synproxy) until the kernel stack guard page is hit. The fix adds validate functions to the objref and objrefmap expressions so nftables rejects such rules with 'Operation not supported.' No public exploit has been identified at time of analysis and EPSS is negligible (0.03%), but a vendor patch is available and Ubuntu has shipped fixes.

Technical ContextAI

The affected component is nf_tables, the modern packet-classification framework in the Linux kernel that replaced iptables. Rules can reference named stateful objects via the objref/objrefmap expressions; one such object type is synproxy (NFT_OBJECT_SYNPROXY), a TCP SYN-flood mitigation that answers incoming SYNs with a SYN-ACK on behalf of a backend. The root cause is a missing validation step (an unbounded-recursion / stack-exhaustion class of bug, CWE-674-like although CWE is listed N/A): when a synproxy object is invoked from the ip6/ip OUTPUT hook, synproxy_send_tcp_ipv6() emits a packet through ip6_local_out(), which re-enters __ip6_local_out() → nf_hook_slow() → nft_do_chain() and re-evaluates the same synproxy object, forming an infinite call chain (visible in the trace as repeating synproxy_send_client_synack_ipv6 → synproxy_send_tcp_ipv6 frames) that overruns the kernel stack. Prior to the fix, nf_tables performed no hook-context validation for objref expressions; the patch implements nft_objref validate callbacks that only permit synproxy references outside the OUTPUT hook (and also covers jumps to a chain that uses a synproxy object).

Affected ProductsAI

The affected product is the mainline and stable Linux kernel, specifically builds compiled with nf_tables and the synproxy object support (CONFIG_NFT_SYNPROXY / netfilter nf_tables). No CPE strings were provided in the intelligence, so exact vulnerable version ranges are not enumerated here; the four git.kernel.org/stable commit references (0028e013, 4c1cf72e, 7ea55a44, f359b809) indicate the fix was backported across multiple stable branches. Distribution-level exposure is confirmed for Ubuntu, whose advisories USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1) and USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) enumerate the specific affected kernel packages and fixed versions.

RemediationAI

Patch available per vendor advisory: update to a kernel that includes the nft_objref validate fix (upstream commits 0028e0134c64, 4c1cf72ec10b, 7ea55a44493a, f359b809d54c on git.kernel.org/stable). Ubuntu users should apply the kernel updates in USN-8125-1 (https://ubuntu.com/security/notices/USN-8125-1) and USN-8126-1 (https://ubuntu.com/security/notices/USN-8126-1) and reboot; other distributions should apply their equivalent kernel security updates. As a compensating control where immediate patching is not possible, audit and prevent nft rulesets that place a synproxy object reference in the OUTPUT hook (post-patch such rules are rejected with 'Operation not supported'), and restrict who can configure netfilter: limit CAP_NET_ADMIN and, in multi-tenant or container hosts, disable unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0) to stop unprivileged local users from crafting the offending ruleset - the trade-off is that this breaks rootless containers and other legitimate userns workloads.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:latest Image SLES15-SP6 Image SLES15-SP6-BYOS Image SLES15-SP6-BYOS-Azure Image SLES15-SP6-BYOS-EC2 Image SLES15-SP6-BYOS-GCE Image SLES15-SP6-CHOST-BYOS Image SLES15-SP6-CHOST-BYOS-Aliyun Image SLES15-SP6-CHOST-BYOS-Azure Image SLES15-SP6-CHOST-BYOS-EC2 Image SLES15-SP6-CHOST-BYOS-GCE Image SLES15-SP6-CHOST-BYOS-GDC Image SLES15-SP6-CHOST-BYOS-SAP-CCloud Image SLES15-SP6-EC2 Image SLES15-SP6-EC2-ECS-HVM Image SLES15-SP6-GCE Image SLES15-SP6-HPC-BYOS Image SLES15-SP6-HPC-BYOS-Azure Image SLES15-SP6-HPC-BYOS-EC2 Image SLES15-SP6-HPC-BYOS-GCE Image SLES15-SP6-HPC-EC2 Image SLES15-SP6-HPC-GCE Image SLES15-SP6-Hardened-BYOS Image SLES15-SP6-Hardened-BYOS-Azure Image SLES15-SP6-Hardened-BYOS-EC2 Image SLES15-SP6-Hardened-BYOS-GCE Image SLES15-SP6-SAP Image SLES15-SP6-SAP-Azure Image SLES15-SP6-SAP-EC2 Image SLES15-SP6-SAP-GCE Image SLES15-SP6-SAPCAL Image SLES15-SP6-SAPCAL-Azure Image SLES15-SP6-SAPCAL-EC2 Image SLES15-SP6-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.1/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.114 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.82 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.116 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.55 Affected

Share

CVE-2025-40206 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy