CVE-2025-21959 (GCVE-0-2025-21959)

Vulnerability from cvelistv5 – Published: 2025-04-01 15:46 – Updated: 2026-08-05 11:55
VLAI
Title
netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() Since commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race"), `cpu` and `jiffies32` were introduced to the struct nf_conncount_tuple. The commit made nf_conncount_add() initialize `conn->cpu` and `conn->jiffies32` when allocating the struct. In contrast, count_tree() was not changed to initialize them. By commit 34848d5c896e ("netfilter: nf_conncount: Split insert and traversal"), count_tree() was split and the relevant allocation code now resides in insert_tree(). Initialize `conn->cpu` and `conn->jiffies32` in insert_tree(). BUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline] BUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 find_or_evict net/netfilter/nf_conncount.c:117 [inline] __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 count_tree net/netfilter/nf_conncount.c:438 [inline] nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669 __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983 __netif_receive_skb_list net/core/dev.c:6035 [inline] netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178 xdp_recv_frames net/bpf/test_run.c:280 [inline] xdp_test_run_batch net/bpf/test_run.c:361 [inline] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 __do_sys_bpf kernel/bpf/syscall.c:5902 [inline] __se_sys_bpf kernel/bpf/syscall.c:5900 [inline] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Uninit was created at: slab_post_alloc_hook mm/slub.c:4121 [inline] slab_alloc_node mm/slub.c:4164 [inline] kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171 insert_tree net/netfilter/nf_conncount.c:372 [inline] count_tree net/netfilter/nf_conncount.c:450 [inline] nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [inline] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [inline] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ip ---truncated---
Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-908 - Use of Uninitialized Resource
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 , < f522229c5563b59b4240261e406779bba6754159 (git)
Affected: b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 , < 2a154ce766b995494e88d8d117fa82cc6b73dd87 (git)
Affected: b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 , < e8544a5a97bee3674e7cd6bf0f3a4af517fa9146 (git)
Affected: b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 , < a62a25c6ad58fae997f48a0749afeda1c252ae51 (git)
Affected: b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 , < fda50302a13701d47fbe01e1739c7a51114144fb (git)
Affected: b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 , < db1e0c0856821c59a32ea3af79476bf20a6beeb2 (git)
Affected: b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 , < 2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc (git)
Affected: b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452 , < d653bfeb07ebb3499c403404c21ac58a16531607 (git)
Affected: 75af3d78168e654a5cd8bbc4c774f97be836165f (git)
Affected: 4.14.92 , < 4.15 (semver)
Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 5.4.292 , ≤ 5.4.* (semver)
Unaffected: 5.10.236 , ≤ 5.10.* (semver)
Unaffected: 5.15.180 , ≤ 5.15.* (semver)
Unaffected: 6.1.132 , ≤ 6.1.* (semver)
Unaffected: 6.6.84 , ≤ 6.6.* (semver)
Unaffected: 6.12.20 , ≤ 6.12.* (semver)
Unaffected: 6.13.8 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21959",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T17:15:56.023953Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-908",
                "description": "CWE-908 Use of Uninitialized Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T17:15:58.938Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:40:01.234Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:40:35.517Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conncount.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f522229c5563b59b4240261e406779bba6754159",
              "status": "affected",
              "version": "b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452",
              "versionType": "git"
            },
            {
              "lessThan": "2a154ce766b995494e88d8d117fa82cc6b73dd87",
              "status": "affected",
              "version": "b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452",
              "versionType": "git"
            },
            {
              "lessThan": "e8544a5a97bee3674e7cd6bf0f3a4af517fa9146",
              "status": "affected",
              "version": "b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452",
              "versionType": "git"
            },
            {
              "lessThan": "a62a25c6ad58fae997f48a0749afeda1c252ae51",
              "status": "affected",
              "version": "b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452",
              "versionType": "git"
            },
            {
              "lessThan": "fda50302a13701d47fbe01e1739c7a51114144fb",
              "status": "affected",
              "version": "b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452",
              "versionType": "git"
            },
            {
              "lessThan": "db1e0c0856821c59a32ea3af79476bf20a6beeb2",
              "status": "affected",
              "version": "b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452",
              "versionType": "git"
            },
            {
              "lessThan": "2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc",
              "status": "affected",
              "version": "b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452",
              "versionType": "git"
            },
            {
              "lessThan": "d653bfeb07ebb3499c403404c21ac58a16531607",
              "status": "affected",
              "version": "b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "75af3d78168e654a5cd8bbc4c774f97be836165f",
              "versionType": "git"
            },
            {
              "lessThan": "4.15",
              "status": "affected",
              "version": "4.14.92",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_conncount.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.292",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.236",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.180",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.132",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.84",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.292",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.236",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.180",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.132",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.84",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.20",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.8",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.14.92",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()\n\nSince commit b36e4523d4d5 (\"netfilter: nf_conncount: fix garbage\ncollection confirm race\"), `cpu` and `jiffies32` were introduced to\nthe struct nf_conncount_tuple.\n\nThe commit made nf_conncount_add() initialize `conn-\u003ecpu` and\n`conn-\u003ejiffies32` when allocating the struct.\nIn contrast, count_tree() was not changed to initialize them.\n\nBy commit 34848d5c896e (\"netfilter: nf_conncount: Split insert and\ntraversal\"), count_tree() was split and the relevant allocation\ncode now resides in insert_tree().\nInitialize `conn-\u003ecpu` and `conn-\u003ejiffies32` in insert_tree().\n\nBUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline]\nBUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143\n find_or_evict net/netfilter/nf_conncount.c:117 [inline]\n __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143\n count_tree net/netfilter/nf_conncount.c:438 [inline]\n nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521\n connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72\n __nft_match_eval net/netfilter/nft_compat.c:403 [inline]\n nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433\n expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288\n nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626\n nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663\n NF_HOOK_LIST include/linux/netfilter.h:350 [inline]\n ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633\n ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669\n __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline]\n __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983\n __netif_receive_skb_list net/core/dev.c:6035 [inline]\n netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126\n netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178\n xdp_recv_frames net/bpf/test_run.c:280 [inline]\n xdp_test_run_batch net/bpf/test_run.c:361 [inline]\n bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390\n bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316\n bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407\n __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813\n __do_sys_bpf kernel/bpf/syscall.c:5902 [inline]\n __se_sys_bpf kernel/bpf/syscall.c:5900 [inline]\n __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900\n ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358\n do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]\n __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387\n do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412\n do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450\n entry_SYSENTER_compat_after_hwframe+0x84/0x8e\n\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:4121 [inline]\n slab_alloc_node mm/slub.c:4164 [inline]\n kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171\n insert_tree net/netfilter/nf_conncount.c:372 [inline]\n count_tree net/netfilter/nf_conncount.c:450 [inline]\n nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521\n connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72\n __nft_match_eval net/netfilter/nft_compat.c:403 [inline]\n nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433\n expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\n nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288\n nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\n nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626\n nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663\n NF_HOOK_LIST include/linux/netfilter.h:350 [inline]\n ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633\n ip_list_rcv+0x9ef/0xa40 net/ip\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable `insert_tree()` allocation and the subsequent `find_or_evict()` read of the uninitialized fields execute in the netfilter packet-receive path (`ip_list_rcv \u2192 nf_hook_slow \u2192 connlimit_mt`/`ovs_ct_check_limit`) on packets arriving from remote peers. A remote host simply sending connections to a box carrying an iptables `-m connlimit` rule or an OVS conntrack zone limit drives the code.\nAC:L - The fields are left uninitialized on every `insert_tree()` allocation, and the attacker controls both sides of the conditioning window by opening many concurrent connections from the same source prefix so entries remain unconfirmed when `find_or_evict()` walks them. `CONFIG_NETFILTER_XT_MATCH_CONNLIMIT` is shipped by all mainstream distributions and connlimit/OVS ct-limit rules are common on internet-facing and cloud deployments, so no rare configuration is required.\nPR:N - The path is reached from raw inbound IP packets processed in a netfilter hook before any authentication or authorization; no account, credential, or capability on the target is needed. The alternative local trigger via unprivileged user namespaces would only be PR:L, so the unauthenticated remote scenario dominates.\nUI:N - Exploitation requires only that the attacker transmit packets to the target; no administrator or user action is needed once the connlimit/ct-limit rule is in place.\nS:U - The uninitialized read and its consequences are confined to the kernel\u0027s own nf_conncount accounting state within the same security authority; no VM, IOMMU, container, or sandbox boundary is crossed.\nC:L - `conn-\u003ecpu` and `conn-\u003ejiffies32` are read from recycled slab memory (the cache is created with flags 0, so it is merge-eligible with other same-size caches) and the values steer whether a packet is accepted or dropped, giving a remote observer a limited, bounded inference channel into residual kernel heap contents. Nothing is copied out directly, so the disclosure is limited rather than arbitrary read.\nI:L - The garbage values corrupt nf_conncount\u0027s eviction heuristic so `list-\u003ecount` no longer reflects the real number of tracked connections, causing the administrator-configured connlimit / OVS per-zone limit to be enforced against a wrong count and letting an attacker exceed it. This is a limited modification of security-relevant kernel state, not an arbitrary write or control-flow hijack.\nA:L - Under-counting defeats a connection-limit control that exists to prevent resource exhaustion, letting an attacker consume more connections than permitted, while transient over-counting drops legitimate traffic from an affected source. The fields are only compared, never dereferenced or used as indices, so there is no oops, panic, hang, or memory corruption \u2014 the result is degradation rather than total loss of availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:37.933Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f522229c5563b59b4240261e406779bba6754159"
        },
        {
          "url": "https://git.kernel.org/stable/c/2a154ce766b995494e88d8d117fa82cc6b73dd87"
        },
        {
          "url": "https://git.kernel.org/stable/c/e8544a5a97bee3674e7cd6bf0f3a4af517fa9146"
        },
        {
          "url": "https://git.kernel.org/stable/c/a62a25c6ad58fae997f48a0749afeda1c252ae51"
        },
        {
          "url": "https://git.kernel.org/stable/c/fda50302a13701d47fbe01e1739c7a51114144fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/db1e0c0856821c59a32ea3af79476bf20a6beeb2"
        },
        {
          "url": "https://git.kernel.org/stable/c/2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/d653bfeb07ebb3499c403404c21ac58a16531607"
        }
      ],
      "title": "netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21959",
    "datePublished": "2025-04-01T15:46:57.775Z",
    "dateReserved": "2024-12-29T08:45:45.793Z",
    "dateUpdated": "2026-08-05T11:55:37.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21959",
      "date": "2026-08-10",
      "epss": "0.00409",
      "percentile": "0.33717"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T03:10:52.000Z",
      "cve": "CVE-2025-21959",
      "id": "msrc_CVE-2025-21959",
      "initial_release_date": "2025-04-02T00:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21959.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21959\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:27.120\",\"lastModified\":\"2026-07-30T06:21:59.427\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()\\n\\nSince commit b36e4523d4d5 (\\\"netfilter: nf_conncount: fix garbage\\ncollection confirm race\\\"), `cpu` and `jiffies32` were introduced to\\nthe struct nf_conncount_tuple.\\n\\nThe commit made nf_conncount_add() initialize `conn-\u003ecpu` and\\n`conn-\u003ejiffies32` when allocating the struct.\\nIn contrast, count_tree() was not changed to initialize them.\\n\\nBy commit 34848d5c896e (\\\"netfilter: nf_conncount: Split insert and\\ntraversal\\\"), count_tree() was split and the relevant allocation\\ncode now resides in insert_tree().\\nInitialize `conn-\u003ecpu` and `conn-\u003ejiffies32` in insert_tree().\\n\\nBUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline]\\nBUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143\\n find_or_evict net/netfilter/nf_conncount.c:117 [inline]\\n __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143\\n count_tree net/netfilter/nf_conncount.c:438 [inline]\\n nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521\\n connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72\\n __nft_match_eval net/netfilter/nft_compat.c:403 [inline]\\n nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433\\n expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\\n nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288\\n nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23\\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\\n nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626\\n nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663\\n NF_HOOK_LIST include/linux/netfilter.h:350 [inline]\\n ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633\\n ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669\\n __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline]\\n __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983\\n __netif_receive_skb_list net/core/dev.c:6035 [inline]\\n netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126\\n netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178\\n xdp_recv_frames net/bpf/test_run.c:280 [inline]\\n xdp_test_run_batch net/bpf/test_run.c:361 [inline]\\n bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390\\n bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316\\n bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407\\n __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813\\n __do_sys_bpf kernel/bpf/syscall.c:5902 [inline]\\n __se_sys_bpf kernel/bpf/syscall.c:5900 [inline]\\n __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900\\n ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358\\n do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]\\n __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387\\n do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412\\n do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450\\n entry_SYSENTER_compat_after_hwframe+0x84/0x8e\\n\\nUninit was created at:\\n slab_post_alloc_hook mm/slub.c:4121 [inline]\\n slab_alloc_node mm/slub.c:4164 [inline]\\n kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171\\n insert_tree net/netfilter/nf_conncount.c:372 [inline]\\n count_tree net/netfilter/nf_conncount.c:450 [inline]\\n nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521\\n connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72\\n __nft_match_eval net/netfilter/nft_compat.c:403 [inline]\\n nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433\\n expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\\n nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288\\n nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23\\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\\n nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626\\n nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663\\n NF_HOOK_LIST include/linux/netfilter.h:350 [inline]\\n ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633\\n ip_list_rcv+0x9ef/0xa40 net/ip\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: nf_conncount: Inicializar completamente la estructura nf_conncount_tuple en insert_tree() Desde el commit b36e4523d4d5 (\\\"netfilter: nf_conncount: corregir la carrera de confirmaci\u00f3n de la recolecci\u00f3n de basura\\\"), se introdujeron `cpu` y `jiffies32` en la estructura nf_conncount_tuple. El commit hizo que nf_conncount_add() inicializara `conn-\u0026gt;cpu` y `conn-\u0026gt;jiffies32` al asignar la estructura. Por el contrario, count_tree() no se modific\u00f3 para inicializarlas. Mediante el commit 34848d5c896e (\\\"netfilter: nf_conncount: Dividir la inserci\u00f3n y el recorrido\\\"), count_tree() se dividi\u00f3 y el c\u00f3digo de asignaci\u00f3n relevante ahora reside en insert_tree(). Inicialice `conn-\u0026gt;cpu` y `conn-\u0026gt;jiffies32` en insert_tree(). ERROR: KMSAN: valor no inicializado en find_or_evict net/netfilter/nf_conncount.c:117 [en l\u00ednea] ERROR: KMSAN: valor no inicializado en __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 find_or_evict net/netfilter/nf_conncount.c:117 [en l\u00ednea] __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143 count_tree net/netfilter/nf_conncount.c:438 [en l\u00ednea] nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [en l\u00ednea] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [en l\u00ednea] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn incluir/linux/netfilter.h:154 [en l\u00ednea] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST incluir/linux/netfilter.h:350 [en l\u00ednea] ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633 ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669 __netif_receive_skb_list_ptype net/core/dev.c:5936 [en l\u00ednea] __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983 __netif_receive_skb_list net/core/dev.c:6035 [en l\u00ednea] netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126 netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178 xdp_recv_frames net/bpf/test_run.c:280 [en l\u00ednea] xdp_test_run_batch net/bpf/test_run.c:361 [en l\u00ednea] bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390 bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316 bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407 __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 __do_sys_bpf kernel/bpf/syscall.c:5902 [en l\u00ednea] __se_sys_bpf kernel/bpf/syscall.c:5900 [en l\u00ednea] __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358 do_syscall_32_irqs_on arch/x86/entry/common.c:165 [en l\u00ednea] __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387 do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Uninit se cre\u00f3 en: slab_post_alloc_hook mm/slub.c:4121 [en l\u00ednea] slab_alloc_node mm/slub.c:4164 [en l\u00ednea] kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171 \u00e1rbol_de_inserci\u00f3n net/netfilter/nf_conncount.c:372 [en l\u00ednea] \u00e1rbol_de_conteo net/netfilter/nf_conncount.c:450 [en l\u00ednea] nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521 connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72 __nft_match_eval net/netfilter/nft_compat.c:403 [en l\u00ednea] nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [en l\u00ednea] nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [en l\u00ednea] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663 NF_HOOK_LIST include/linux/netfilter.h:350 [en l\u00ednea] ip_sublist_rcv+0x17b7/0x17f0 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nf_conncount.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\",\"lessThan\":\"f522229c5563b59b4240261e406779bba6754159\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\",\"lessThan\":\"2a154ce766b995494e88d8d117fa82cc6b73dd87\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\",\"lessThan\":\"e8544a5a97bee3674e7cd6bf0f3a4af517fa9146\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\",\"lessThan\":\"a62a25c6ad58fae997f48a0749afeda1c252ae51\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\",\"lessThan\":\"fda50302a13701d47fbe01e1739c7a51114144fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\",\"lessThan\":\"db1e0c0856821c59a32ea3af79476bf20a6beeb2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\",\"lessThan\":\"2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\",\"lessThan\":\"d653bfeb07ebb3499c403404c21ac58a16531607\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"75af3d78168e654a5cd8bbc4c774f97be836165f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.14.92\",\"lessThan\":\"4.15\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nf_conncount.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.292\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.236\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.180\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.132\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.84\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.20\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.8\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":7.3,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":3.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T17:15:56.023953Z\",\"id\":\"CVE-2025-21959\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-908\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.14.92\",\"versionEndExcluding\":\"4.15\",\"matchCriteriaId\":\"38A1AC7C-17D5-4E10-97A0-ED3637CD9D40\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.18\",\"versionEndExcluding\":\"5.4.292\",\"matchCriteriaId\":\"1A0A6CD9-3ED4-4FB3-80EE-9BF216598C6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.236\",\"matchCriteriaId\":\"1DF46FB0-9163-4ABE-8CCA-32A497D4715B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.180\",\"matchCriteriaId\":\"D19801C8-3D18-405D-9989-E6C9B30255FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.132\",\"matchCriteriaId\":\"91D1C2F6-55A1-4CF4-AC66-ADF758259C59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.84\",\"matchCriteriaId\":\"994E0F00-FAC4-40E4-9068-C7D4D8242EC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.20\",\"matchCriteriaId\":\"60E9C5DF-D778-4572-848A-5D6CFFE022CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.8\",\"matchCriteriaId\":\"0A20D4D7-B329-4C68-B662-76062EA7DCF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"45B90F6B-BEC7-4D4E-883A-9DBADE021750\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1759FFB7-531C-41B1-9AE1-FD3D80E0D920\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2a154ce766b995494e88d8d117fa82cc6b73dd87\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a62a25c6ad58fae997f48a0749afeda1c252ae51\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d653bfeb07ebb3499c403404c21ac58a16531607\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/db1e0c0856821c59a32ea3af79476bf20a6beeb2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e8544a5a97bee3674e7cd6bf0f3a4af517fa9146\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f522229c5563b59b4240261e406779bba6754159\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fda50302a13701d47fbe01e1739c7a51114144fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:37:52+00:00",
      "cve": "CVE-2025-21959",
      "id": "CVE-2025-21959",
      "initial_release_date": "2025-04-01T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21959.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-16T18:50:44Z",
      "cve": "CVE-2025-21959",
      "id": "CVE-2025-21959",
      "initial_release_date": "2025-04-05T02:25:28Z",
      "product_status:known_affected": "618",
      "product_status:known_not_affected": "101",
      "product_status:recommended": "407",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21959",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21959.json",
      "version": "47"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T19:40:01.234Z\"}}, {\"affected\": [{\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\", \"versions\": [{\"status\": \"affected\", \"version\": \"V3.1.6\", \"lessThan\": \"*\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"x_adpType\": \"supplier\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\"}], \"providerMetadata\": {\"orgId\": \"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\", \"shortName\": \"siemens-SADP\", \"dateUpdated\": \"2026-07-14T12:40:35.517Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21959\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T17:15:56.023953Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-908\", \"description\": \"CWE-908 Use of Uninitialized Resource\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T14:38:26.723Z\"}}], \"cna\": {\"title\": \"netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.3, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:N - The vulnerable `insert_tree()` allocation and the subsequent `find_or_evict()` read of the uninitialized fields execute in the netfilter packet-receive path (`ip_list_rcv \\u2192 nf_hook_slow \\u2192 connlimit_mt`/`ovs_ct_check_limit`) on packets arriving from remote peers. A remote host simply sending connections to a box carrying an iptables `-m connlimit` rule or an OVS conntrack zone limit drives the code.\\nAC:L - The fields are left uninitialized on every `insert_tree()` allocation, and the attacker controls both sides of the conditioning window by opening many concurrent connections from the same source prefix so entries remain unconfirmed when `find_or_evict()` walks them. `CONFIG_NETFILTER_XT_MATCH_CONNLIMIT` is shipped by all mainstream distributions and connlimit/OVS ct-limit rules are common on internet-facing and cloud deployments, so no rare configuration is required.\\nPR:N - The path is reached from raw inbound IP packets processed in a netfilter hook before any authentication or authorization; no account, credential, or capability on the target is needed. The alternative local trigger via unprivileged user namespaces would only be PR:L, so the unauthenticated remote scenario dominates.\\nUI:N - Exploitation requires only that the attacker transmit packets to the target; no administrator or user action is needed once the connlimit/ct-limit rule is in place.\\nS:U - The uninitialized read and its consequences are confined to the kernel\u0027s own nf_conncount accounting state within the same security authority; no VM, IOMMU, container, or sandbox boundary is crossed.\\nC:L - `conn-\u003ecpu` and `conn-\u003ejiffies32` are read from recycled slab memory (the cache is created with flags 0, so it is merge-eligible with other same-size caches) and the values steer whether a packet is accepted or dropped, giving a remote observer a limited, bounded inference channel into residual kernel heap contents. Nothing is copied out directly, so the disclosure is limited rather than arbitrary read.\\nI:L - The garbage values corrupt nf_conncount\u0027s eviction heuristic so `list-\u003ecount` no longer reflects the real number of tracked connections, causing the administrator-configured connlimit / OVS per-zone limit to be enforced against a wrong count and letting an attacker exceed it. This is a limited modification of security-relevant kernel state, not an arbitrary write or control-flow hijack.\\nA:L - Under-counting defeats a connection-limit control that exists to prevent resource exhaustion, letting an attacker consume more connections than permitted, while transient over-counting drops legitimate traffic from an affected source. The fields are only compared, never dereferenced or used as indices, so there is no oops, panic, hang, or memory corruption \\u2014 the result is degradation rather than total loss of availability.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\", \"lessThan\": \"f522229c5563b59b4240261e406779bba6754159\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\", \"lessThan\": \"2a154ce766b995494e88d8d117fa82cc6b73dd87\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\", \"lessThan\": \"e8544a5a97bee3674e7cd6bf0f3a4af517fa9146\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\", \"lessThan\": \"a62a25c6ad58fae997f48a0749afeda1c252ae51\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\", \"lessThan\": \"fda50302a13701d47fbe01e1739c7a51114144fb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\", \"lessThan\": \"db1e0c0856821c59a32ea3af79476bf20a6beeb2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\", \"lessThan\": \"2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"b36e4523d4d56e2595e28f16f6ccf1cd6a9fc452\", \"lessThan\": \"d653bfeb07ebb3499c403404c21ac58a16531607\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"75af3d78168e654a5cd8bbc4c774f97be836165f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4.14.92\", \"lessThan\": \"4.15\", \"versionType\": \"semver\"}], \"programFiles\": [\"net/netfilter/nf_conncount.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.292\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.236\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.180\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.132\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.84\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.20\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"net/netfilter/nf_conncount.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f522229c5563b59b4240261e406779bba6754159\"}, {\"url\": \"https://git.kernel.org/stable/c/2a154ce766b995494e88d8d117fa82cc6b73dd87\"}, {\"url\": \"https://git.kernel.org/stable/c/e8544a5a97bee3674e7cd6bf0f3a4af517fa9146\"}, {\"url\": \"https://git.kernel.org/stable/c/a62a25c6ad58fae997f48a0749afeda1c252ae51\"}, {\"url\": \"https://git.kernel.org/stable/c/fda50302a13701d47fbe01e1739c7a51114144fb\"}, {\"url\": \"https://git.kernel.org/stable/c/db1e0c0856821c59a32ea3af79476bf20a6beeb2\"}, {\"url\": \"https://git.kernel.org/stable/c/2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc\"}, {\"url\": \"https://git.kernel.org/stable/c/d653bfeb07ebb3499c403404c21ac58a16531607\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()\\n\\nSince commit b36e4523d4d5 (\\\"netfilter: nf_conncount: fix garbage\\ncollection confirm race\\\"), `cpu` and `jiffies32` were introduced to\\nthe struct nf_conncount_tuple.\\n\\nThe commit made nf_conncount_add() initialize `conn-\u003ecpu` and\\n`conn-\u003ejiffies32` when allocating the struct.\\nIn contrast, count_tree() was not changed to initialize them.\\n\\nBy commit 34848d5c896e (\\\"netfilter: nf_conncount: Split insert and\\ntraversal\\\"), count_tree() was split and the relevant allocation\\ncode now resides in insert_tree().\\nInitialize `conn-\u003ecpu` and `conn-\u003ejiffies32` in insert_tree().\\n\\nBUG: KMSAN: uninit-value in find_or_evict net/netfilter/nf_conncount.c:117 [inline]\\nBUG: KMSAN: uninit-value in __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143\\n find_or_evict net/netfilter/nf_conncount.c:117 [inline]\\n __nf_conncount_add+0xd9c/0x2850 net/netfilter/nf_conncount.c:143\\n count_tree net/netfilter/nf_conncount.c:438 [inline]\\n nf_conncount_count+0x82f/0x1e80 net/netfilter/nf_conncount.c:521\\n connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72\\n __nft_match_eval net/netfilter/nft_compat.c:403 [inline]\\n nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433\\n expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\\n nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288\\n nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23\\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\\n nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626\\n nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663\\n NF_HOOK_LIST include/linux/netfilter.h:350 [inline]\\n ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633\\n ip_list_rcv+0x9ef/0xa40 net/ipv4/ip_input.c:669\\n __netif_receive_skb_list_ptype net/core/dev.c:5936 [inline]\\n __netif_receive_skb_list_core+0x15c5/0x1670 net/core/dev.c:5983\\n __netif_receive_skb_list net/core/dev.c:6035 [inline]\\n netif_receive_skb_list_internal+0x1085/0x1700 net/core/dev.c:6126\\n netif_receive_skb_list+0x5a/0x460 net/core/dev.c:6178\\n xdp_recv_frames net/bpf/test_run.c:280 [inline]\\n xdp_test_run_batch net/bpf/test_run.c:361 [inline]\\n bpf_test_run_xdp_live+0x2e86/0x3480 net/bpf/test_run.c:390\\n bpf_prog_test_run_xdp+0xf1d/0x1ae0 net/bpf/test_run.c:1316\\n bpf_prog_test_run+0x5e5/0xa30 kernel/bpf/syscall.c:4407\\n __sys_bpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813\\n __do_sys_bpf kernel/bpf/syscall.c:5902 [inline]\\n __se_sys_bpf kernel/bpf/syscall.c:5900 [inline]\\n __ia32_sys_bpf+0xa0/0xe0 kernel/bpf/syscall.c:5900\\n ia32_sys_call+0x394d/0x4180 arch/x86/include/generated/asm/syscalls_32.h:358\\n do_syscall_32_irqs_on arch/x86/entry/common.c:165 [inline]\\n __do_fast_syscall_32+0xb0/0x110 arch/x86/entry/common.c:387\\n do_fast_syscall_32+0x38/0x80 arch/x86/entry/common.c:412\\n do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:450\\n entry_SYSENTER_compat_after_hwframe+0x84/0x8e\\n\\nUninit was created at:\\n slab_post_alloc_hook mm/slub.c:4121 [inline]\\n slab_alloc_node mm/slub.c:4164 [inline]\\n kmem_cache_alloc_noprof+0x915/0xe10 mm/slub.c:4171\\n insert_tree net/netfilter/nf_conncount.c:372 [inline]\\n count_tree net/netfilter/nf_conncount.c:450 [inline]\\n nf_conncount_count+0x1415/0x1e80 net/netfilter/nf_conncount.c:521\\n connlimit_mt+0x7f6/0xbd0 net/netfilter/xt_connlimit.c:72\\n __nft_match_eval net/netfilter/nft_compat.c:403 [inline]\\n nft_match_eval+0x1a5/0x300 net/netfilter/nft_compat.c:433\\n expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]\\n nft_do_chain+0x426/0x2290 net/netfilter/nf_tables_core.c:288\\n nft_do_chain_ipv4+0x1a5/0x230 net/netfilter/nft_chain_filter.c:23\\n nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]\\n nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626\\n nf_hook_slow_list+0x24d/0x860 net/netfilter/core.c:663\\n NF_HOOK_LIST include/linux/netfilter.h:350 [inline]\\n ip_sublist_rcv+0x17b7/0x17f0 net/ipv4/ip_input.c:633\\n ip_list_rcv+0x9ef/0xa40 net/ip\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.292\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.236\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.180\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.132\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.84\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.20\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.8\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"4.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"4.14.92\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:55:37.933Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21959\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:55:37.933Z\", \"dateReserved\": \"2024-12-29T08:45:45.793Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-04-01T15:46:57.775Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.