cbcvebase.
CVE-2025-21958
published 2025-04-01

CVE-2025-21958: In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently…

PriorityP416medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.14%
4.3th percentile
In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovs_ct_set_labels() is only called for confirmed conntrack entries (ct) within ovs_ct_commit(). However, if the conntrack entry does not have the labels_ext extension, attempting to allocate it in ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in nf_ct_ext_add(): WARN_ON(nf_ct_is_confirmed(ct)); This happens when the conntrack entry is created externally before OVS increments net->ct.labels_used. The issue has become more likely since commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting in conntrack"), which changed to use per-action label counting and increment net->ct.labels_used when a flow with ct action is added. Since there’s no straightforward way to fully resolve this issue at the moment, this reverts the commit to avoid breaking existing use cases.

Affected

15 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.12.20-1 (forky)linux 6.12.20-1 (forky)
linuxlinux
linuxlinux>= fcb1aa5163b1ae4cf2864b688b08927aac51f51e < 9e79fdabd52cfce1a021640a81256878a2c516a29e79fdabd52cfce1a021640a81256878a2c516a2
linuxlinux>= fcb1aa5163b1ae4cf2864b688b08927aac51f51e < d91bfc64a4886102746e74d2c6f3a61e9a77fd7dd91bfc64a4886102746e74d2c6f3a61e9a77fd7d
linuxlinux>= fcb1aa5163b1ae4cf2864b688b08927aac51f51e < 1063ae07383c0ddc5bcce170260c143825846b031063ae07383c0ddc5bcce170260c143825846b03
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel
linuxlinux_kernel>= 0 < 6.12.20-16.12.20-1
linuxlinux_kernel>= 0 < 6.12.20-16.12.20-1
linuxlinux_kernel>= 6.12 < 6.12.206.12.20
linuxlinux_kernel>= 6.13 < 6.13.86.13.8

CVSS provenance

nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
osv4.7MEDIUM
vendor_debian4.7LOW
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.