CVE-2025-38678

MEDIUM EPSS 10.3%
Published Sep 3, 202510mo ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Sep 3, 2025 10mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject duplicate device on updates A chain/flowtable update with duplicated devices in the same batch is possible. Unfortunately, netdev event path only removes the first device that is found, leaving unregistered the hook of the duplicated device. Check if a duplicated device exists in the transaction batch, bail out with EEXIST in such case. WARNING is hit when unregistering the hook: [49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150 [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S 6.16.0+ #170 PREEMPT(full) [...] [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
10.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Affected Products 4

VendorProductVersionRange
linuxlinux_kernel*≥5.8  –  <6.6.117
linuxlinux_kernel*≥6.7  –  <6.12.59
linuxlinux_kernel*≥6.13  –  <6.16.2
linuxlinux_kernel6.17any

References 7

  • git.kernel.org https://git.kernel.org/stable/c/0521e694d5b80899fba8695881a6349f9bc538cb
  • git.kernel.org https://git.kernel.org/stable/c/3f358a66a04513311668ea4b40f5064e253d8386
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/4681960bc0f4f8bcc782cbf2fd205f48ad314dfd
  • git.kernel.org https://git.kernel.org/stable/c/4ce2a0c3b8497a66cfc25fc7ca3d087258a785d2
  • git.kernel.org https://git.kernel.org/stable/c/cf23d531a9d496863aa4c5a0e2f71f0a23f3df3c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d7615bde541f16517d6790412da6ec46fa8a4c1f
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/3f358a66a04513311668ea4b40f5064e253d8386
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cf23d531a9d496863aa4c5a0e2f71f0a23f3df3c
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d7615bde541f16517d6790412da6ec46fa8a4c1f
    Patch