CVE-2025-21958 — Time-of-check Time-of-use (TOCTOU) Race Condition in Linux
Severity
4.7MEDIUMNVD
EPSS
0.0%
top 88.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 1
Description
In the Linux kernel, the following vulnerability has been resolved:
Revert "openvswitch: switch to per-action label counting in conntrack"
Currently, ovs_ct_set_labels() is only called for confirmed conntrack
entries (ct) within ovs_ct_commit(). However, if the conntrack entry
does not have the labels_ext extension, attempting to allocate it in
ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in
nf_ct_ext_add():
WARN_ON(nf_ct_is_confirmed(ct));
This happens when the conntrac…
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.0 | Impact: 3.6
Affected Packages4 packages
▶CVEListV5linux/linuxfcb1aa5163b1ae4cf2864b688b08927aac51f51e — 9e79fdabd52cfce1a021640a81256878a2c516a2+3
Patches
🔴Vulnerability Details
2GHSA▶
GHSA-jx6v-7wmg-pq67: In the Linux kernel, the following vulnerability has been resolved:
Revert "openvswitch: switch to per-action label counting in conntrack"
Currently↗2025-04-01
OSV▶
CVE-2025-21958: In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently,↗2025-04-01