CVE-2025-21958
published 2025-04-01CVE-2025-21958: In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently…
PriorityP416medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.14%
4.3th percentile
In the Linux kernel, the following vulnerability has been resolved:
Revert "openvswitch: switch to per-action label counting in conntrack"
Currently, ovs_ct_set_labels() is only called for confirmed conntrack
entries (ct) within ovs_ct_commit(). However, if the conntrack entry
does not have the labels_ext extension, attempting to allocate it in
ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in
nf_ct_ext_add():
WARN_ON(nf_ct_is_confirmed(ct));
This happens when the conntrack entry is created externally before OVS
increments net->ct.labels_used. The issue has become more likely since
commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting
in conntrack"), which changed to use per-action label counting and
increment net->ct.labels_used when a flow with ct action is added.
Since there’s no straightforward way to fully resolve this issue at the
moment, this reverts the commit to avoid breaking existing use cases.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.12.20-1 (forky) | linux 6.12.20-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= fcb1aa5163b1ae4cf2864b688b08927aac51f51e < 9e79fdabd52cfce1a021640a81256878a2c516a2 | 9e79fdabd52cfce1a021640a81256878a2c516a2 |
| linux | linux | >= fcb1aa5163b1ae4cf2864b688b08927aac51f51e < d91bfc64a4886102746e74d2c6f3a61e9a77fd7d | d91bfc64a4886102746e74d2c6f3a61e9a77fd7d |
| linux | linux | >= fcb1aa5163b1ae4cf2864b688b08927aac51f51e < 1063ae07383c0ddc5bcce170260c143825846b03 | 1063ae07383c0ddc5bcce170260c143825846b03 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.12.20-1 | 6.12.20-1 |
| linux | linux_kernel | >= 0 < 6.12.20-1 | 6.12.20-1 |
| linux | linux_kernel | >= 6.12 < 6.12.20 | 6.12.20 |
| linux | linux_kernel | >= 6.13 < 6.13.8 | 6.13.8 |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7LOW
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Revert "openvswitch: switch to per-action label counting in conntrack"
vendor_redhat·2025-04-01·CVSS 4.7
CVE-2025-21958 [MEDIUM] CWE-367 kernel: Revert "openvswitch: switch to per-action label counting in conntrack"
kernel: Revert "openvswitch: switch to per-action label counting in conntrack"
In the Linux kernel, the following vulnerability has been resolved:
Revert "openvswitch: switch to per-action label counting in conntrack"
Currently, ovs_ct_set_labels() is only called for confirmed conntrack
entries (ct) within ovs_ct_commit(). However, if the conntrack entry
does not have the labels_ext extension, attempting to allocate it in
ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in
nf_ct_ext_add():
WARN_ON(nf_ct_is_confirmed(ct));
This happens when the conntrack entry is created externally before OVS
increments net->ct.labels_used. The issue has become more likely since
commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting
in conntrack"), which changed to use per-
Debian
CVE-2025-21958: linux - In the Linux kernel, the following vulnerability has been resolved: Revert "ope...
vendor_debian·2025·CVSS 4.7
CVE-2025-21958 [MEDIUM] CVE-2025-21958: linux - In the Linux kernel, the following vulnerability has been resolved: Revert "ope...
In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovs_ct_set_labels() is only called for confirmed conntrack entries (ct) within ovs_ct_commit(). However, if the conntrack entry does not have the labels_ext extension, attempting to allocate it in ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in nf_ct_ext_add(): WARN_ON(nf_ct_is_confirmed(ct)); This happens when the conntrack entry is created externally before OVS increments net->ct.labels_used. The issue has become more likely since commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting in conntrack"), which changed to use per-action label counting and increment net->ct.labels_used when a flow with ct acti
VulDB
Linux Kernel up to 6.12.19/6.13.7 ovs_ct_set_labels allocation of resources (WID-SEC-2025-0683)
vuldb·2026-07-31·CVSS 4.7
CVE-2025-21958 [MEDIUM] Linux Kernel up to 6.12.19/6.13.7 ovs_ct_set_labels allocation of resources (WID-SEC-2025-0683)
A vulnerability categorized as problematic has been discovered in Linux Kernel up to 6.12.19/6.13.7. Affected by this issue is the function ovs_ct_set_labels. The manipulation results in allocation of resources.
This vulnerability was named CVE-2025-21958. The attack needs to be approached within the local network. There is no available exploit.
It is advisable to upgrade the affected component.
GHSA
GHSA-jx6v-7wmg-pq67: In the Linux kernel, the following vulnerability has been resolved:
Revert "openvswitch: switch to per-action label counting in conntrack"
Currently
ghsa_unreviewed·2025-04-01
CVE-2025-21958 [MEDIUM] CWE-367 GHSA-jx6v-7wmg-pq67: In the Linux kernel, the following vulnerability has been resolved:
Revert "openvswitch: switch to per-action label counting in conntrack"
Currently
In the Linux kernel, the following vulnerability has been resolved:
Revert "openvswitch: switch to per-action label counting in conntrack"
Currently, ovs_ct_set_labels() is only called for confirmed conntrack
entries (ct) within ovs_ct_commit(). However, if the conntrack entry
does not have the labels_ext extension, attempting to allocate it in
ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in
nf_ct_ext_add():
WARN_ON(nf_ct_is_confirmed(ct));
This happens when the conntrack entry is created externally before OVS
increments net->ct.labels_used. The issue has become more likely since
commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting
in conntrack"), which changed to use per-action label counting and
increment net->ct.labels_used when a flow with ct
OSV
CVE-2025-21958: In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently,
osv·2025-04-01·CVSS 4.7
CVE-2025-21958 [MEDIUM] CVE-2025-21958: In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently,
In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovs_ct_set_labels() is only called for confirmed conntrack entries (ct) within ovs_ct_commit(). However, if the conntrack entry does not have the labels_ext extension, attempting to allocate it in ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in nf_ct_ext_add(): WARN_ON(nf_ct_is_confirmed(ct)); This happens when the conntrack entry is created externally before OVS increments net->ct.labels_used. The issue has become more likely since commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting in conntrack"), which changed to use per-action label counting and increment net->ct.labels_used when a flow with ct acti
No detection rules found.
No public exploits indexed.
2025-04-01
Published