GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-40206 (GCVE-0-2025-40206)

Vulnerability from cvelistv5 – Published: 2025-11-12 21:56 – Updated: 2026-08-23 12:45
VLAI
Title
netfilter: nft_objref: validate objref and objrefmap expressions
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace: __find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 nft_synproxy_do_eval+0x263/0x310 nft_do_chain+0x5a8/0x5f0 [nf_tables nft_do_chain_inet+0x98/0x110 nf_hook_slow+0x43/0xc0 __ip6_local_out+0xf0/0x170 ip6_local_out+0x17/0x70 synproxy_send_tcp_ipv6+0x1a2/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 [...] Implement objref and objrefmap expression validate functions. Currently, only NFT_OBJECT_SYNPROXY object type requires validation. This will also handle a jump to a chain using a synproxy object from the OUTPUT hook. Now when trying to reference a synproxy object in the OUTPUT hook, nft will produce the following error: synproxy_crash.nft: Error: Could not process rule: Operation not supported synproxy name mysynproxy ^^^^^^^^^^^^^^^^^^^^^^^^
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ee394f96ad7517fbc0de9106dcc7ce9efb14f264 , < f31bcea12222a26d6f151df9c4a6d21f2eec1724 (git)
Affected: ee394f96ad7517fbc0de9106dcc7ce9efb14f264 , < 0028e0134c64d9ed21728341a74fcfc59cd0f944 (git)
Affected: ee394f96ad7517fbc0de9106dcc7ce9efb14f264 , < 7ea55a44493a5a36c3b3293b88bbe4841f9dbaf0 (git)
Affected: ee394f96ad7517fbc0de9106dcc7ce9efb14f264 , < 4c1cf72ec10be5a9ad264650cadffa1fbce6fabd (git)
Affected: ee394f96ad7517fbc0de9106dcc7ce9efb14f264 , < f359b809d54c6e3dd1d039b97e0b68390b0e53e4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 6.1.184 , ≤ 6.1.* (semver)
Unaffected: 6.6.113 , ≤ 6.6.* (semver)
Unaffected: 6.12.54 , ≤ 6.12.* (semver)
Unaffected: 6.17.4 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_objref.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f31bcea12222a26d6f151df9c4a6d21f2eec1724",
              "status": "affected",
              "version": "ee394f96ad7517fbc0de9106dcc7ce9efb14f264",
              "versionType": "git"
            },
            {
              "lessThan": "0028e0134c64d9ed21728341a74fcfc59cd0f944",
              "status": "affected",
              "version": "ee394f96ad7517fbc0de9106dcc7ce9efb14f264",
              "versionType": "git"
            },
            {
              "lessThan": "7ea55a44493a5a36c3b3293b88bbe4841f9dbaf0",
              "status": "affected",
              "version": "ee394f96ad7517fbc0de9106dcc7ce9efb14f264",
              "versionType": "git"
            },
            {
              "lessThan": "4c1cf72ec10be5a9ad264650cadffa1fbce6fabd",
              "status": "affected",
              "version": "ee394f96ad7517fbc0de9106dcc7ce9efb14f264",
              "versionType": "git"
            },
            {
              "lessThan": "f359b809d54c6e3dd1d039b97e0b68390b0e53e4",
              "status": "affected",
              "version": "ee394f96ad7517fbc0de9106dcc7ce9efb14f264",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nft_objref.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.184",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.113",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.54",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.4",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_objref: validate objref and objrefmap expressions\n\nReferencing a synproxy stateful object from OUTPUT hook causes kernel\ncrash due to infinite recursive calls:\n\nBUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12)\n[...]\nCall Trace:\n __find_rr_leaf+0x99/0x230\n fib6_table_lookup+0x13b/0x2d0\n ip6_pol_route+0xa4/0x400\n fib6_rule_lookup+0x156/0x240\n ip6_route_output_flags+0xc6/0x150\n __nf_ip6_route+0x23/0x50\n synproxy_send_tcp_ipv6+0x106/0x200\n synproxy_send_client_synack_ipv6+0x1aa/0x1f0\n nft_synproxy_do_eval+0x263/0x310\n nft_do_chain+0x5a8/0x5f0 [nf_tables\n nft_do_chain_inet+0x98/0x110\n nf_hook_slow+0x43/0xc0\n __ip6_local_out+0xf0/0x170\n ip6_local_out+0x17/0x70\n synproxy_send_tcp_ipv6+0x1a2/0x200\n synproxy_send_client_synack_ipv6+0x1aa/0x1f0\n[...]\n\nImplement objref and objrefmap expression validate functions.\n\nCurrently, only NFT_OBJECT_SYNPROXY object type requires validation.\nThis will also handle a jump to a chain using a synproxy object from the\nOUTPUT hook.\n\nNow when trying to reference a synproxy object in the OUTPUT hook, nft\nwill produce the following error:\n\nsynproxy_crash.nft: Error: Could not process rule: Operation not supported\n  synproxy name mysynproxy\n  ^^^^^^^^^^^^^^^^^^^^^^^^"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is enabled through an nftables ruleset installed over the NFNL_SUBSYS_NFTABLES netlink socket, and triggered by a locally-generated TCP SYN traversing the OUTPUT hook. Per netfilter/nftables convention this is a local attack surface, not a remotely reachable one.\nAC:L - Exploitation is fully deterministic \u2014 add a synproxy object reference to an OUTPUT base chain and emit any TCP SYN; there is no race, no memory-layout dependency, and no bound on the recursion depth. CONFIG_NFT_SYNPROXY is standard and autoloadable on distribution kernels.\nPR:L - nfnetlink_rcv checks netlink_net_capable(skb, CAP_NET_ADMIN), which evaluates against the network namespace\u0027s owning user namespace, so any unprivileged local user obtains it via `unshare -Urn`; nft_synproxy_do_init imposes no init_user_ns requirement. The resulting stack overflow is not confined to the namespace and takes down the host.\nUI:N - The attacker performs both steps \u2014 installing the rule and emitting the triggering SYN \u2014 with no action required from any other user or administrator.\nS:U - The recursion, the stack exhaustion, and the resulting panic all occur within the kernel\u0027s own security authority; no hypervisor, IOMMU, or other trust boundary is crossed.\nC:H - The unbounded recursion exhausts the kernel stack, and on the many embedded/IoT/automotive configurations lacking CONFIG_VMAP_STACK (arm32 without ARM_HAS_GROUP_RELOCS, and architectures with no VMAP_STACK support) it runs past the stack into adjacent kernel pages rather than into a guard page, corrupting neighbouring structures that can be leveraged for kernel memory disclosure.\nI:H - On those same non-VMAP_STACK configurations the overrun writes attacker-influenced frame contents \u2014 struct flowi6 built from the attacker\u0027s SYN addresses/ports, synproxy_options with attacker-chosen MSS/wscale/timestamps, and nft_regs \u2014 into adjacent kernel memory, and on architectures where thread_info sits at the stack base it clobbers that first, yielding an exploitable corruption primitive.\nA:H - The infinite recursion reliably exhausts the kernel stack and hits the guard page, producing an immediate kernel panic as shown in the reporter\u0027s trace. This is a complete denial of service triggerable at will by an unprivileged local user."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-23T12:45:25.956Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f31bcea12222a26d6f151df9c4a6d21f2eec1724"
        },
        {
          "url": "https://git.kernel.org/stable/c/0028e0134c64d9ed21728341a74fcfc59cd0f944"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ea55a44493a5a36c3b3293b88bbe4841f9dbaf0"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c1cf72ec10be5a9ad264650cadffa1fbce6fabd"
        },
        {
          "url": "https://git.kernel.org/stable/c/f359b809d54c6e3dd1d039b97e0b68390b0e53e4"
        }
      ],
      "title": "netfilter: nft_objref: validate objref and objrefmap expressions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40206",
    "datePublished": "2025-11-12T21:56:35.675Z",
    "dateReserved": "2025-04-16T07:20:57.179Z",
    "dateUpdated": "2026-08-23T12:45:25.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40206",
      "date": "2026-09-16",
      "epss": "0.00142",
      "percentile": "0.03912"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40206\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-11-12T22:15:47.893\",\"lastModified\":\"2026-08-23T13:16:26.737\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nft_objref: validate objref and objrefmap expressions\\n\\nReferencing a synproxy stateful object from OUTPUT hook causes kernel\\ncrash due to infinite recursive calls:\\n\\nBUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12)\\n[...]\\nCall Trace:\\n __find_rr_leaf+0x99/0x230\\n fib6_table_lookup+0x13b/0x2d0\\n ip6_pol_route+0xa4/0x400\\n fib6_rule_lookup+0x156/0x240\\n ip6_route_output_flags+0xc6/0x150\\n __nf_ip6_route+0x23/0x50\\n synproxy_send_tcp_ipv6+0x106/0x200\\n synproxy_send_client_synack_ipv6+0x1aa/0x1f0\\n nft_synproxy_do_eval+0x263/0x310\\n nft_do_chain+0x5a8/0x5f0 [nf_tables\\n nft_do_chain_inet+0x98/0x110\\n nf_hook_slow+0x43/0xc0\\n __ip6_local_out+0xf0/0x170\\n ip6_local_out+0x17/0x70\\n synproxy_send_tcp_ipv6+0x1a2/0x200\\n synproxy_send_client_synack_ipv6+0x1aa/0x1f0\\n[...]\\n\\nImplement objref and objrefmap expression validate functions.\\n\\nCurrently, only NFT_OBJECT_SYNPROXY object type requires validation.\\nThis will also handle a jump to a chain using a synproxy object from the\\nOUTPUT hook.\\n\\nNow when trying to reference a synproxy object in the OUTPUT hook, nft\\nwill produce the following error:\\n\\nsynproxy_crash.nft: Error: Could not process rule: Operation not supported\\n  synproxy name mysynproxy\\n  ^^^^^^^^^^^^^^^^^^^^^^^^\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nft_objref.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ee394f96ad7517fbc0de9106dcc7ce9efb14f264\",\"lessThan\":\"f31bcea12222a26d6f151df9c4a6d21f2eec1724\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ee394f96ad7517fbc0de9106dcc7ce9efb14f264\",\"lessThan\":\"0028e0134c64d9ed21728341a74fcfc59cd0f944\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ee394f96ad7517fbc0de9106dcc7ce9efb14f264\",\"lessThan\":\"7ea55a44493a5a36c3b3293b88bbe4841f9dbaf0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ee394f96ad7517fbc0de9106dcc7ce9efb14f264\",\"lessThan\":\"4c1cf72ec10be5a9ad264650cadffa1fbce6fabd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ee394f96ad7517fbc0de9106dcc7ce9efb14f264\",\"lessThan\":\"f359b809d54c6e3dd1d039b97e0b68390b0e53e4\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nft_objref.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.184\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.113\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.54\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.4\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0028e0134c64d9ed21728341a74fcfc59cd0f944\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4c1cf72ec10be5a9ad264650cadffa1fbce6fabd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7ea55a44493a5a36c3b3293b88bbe4841f9dbaf0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f31bcea12222a26d6f151df9c4a6d21f2eec1724\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f359b809d54c6e3dd1d039b97e0b68390b0e53e4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:48:32+00:00",
      "cve": "CVE-2025-40206",
      "id": "CVE-2025-40206",
      "initial_release_date": "2025-11-12T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nft_objref: validate objref and objrefmap expressions",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40206.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:54:59Z",
      "cve": "CVE-2025-40206",
      "id": "CVE-2025-40206",
      "initial_release_date": "2025-11-14T00:23:41Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "435",
      "product_status:known_not_affected": "341",
      "product_status:recommended": "464",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40206",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40206.json",
      "version": "36"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.