CVE-2025-21958 (GCVE-0-2025-21958)
Vulnerability from cvelistv5
Published
2025-04-01 15:46
Modified
2025-05-04 07:25
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: Revert "openvswitch: switch to per-action label counting in conntrack" Currently, ovs_ct_set_labels() is only called for confirmed conntrack entries (ct) within ovs_ct_commit(). However, if the conntrack entry does not have the labels_ext extension, attempting to allocate it in ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in nf_ct_ext_add(): WARN_ON(nf_ct_is_confirmed(ct)); This happens when the conntrack entry is created externally before OVS increments net->ct.labels_used. The issue has become more likely since commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting in conntrack"), which changed to use per-action label counting and increment net->ct.labels_used when a flow with ct action is added. Since there’s no straightforward way to fully resolve this issue at the moment, this reverts the commit to avoid breaking existing use cases.
References
Impacted products
Vendor Product Version
Linux Linux Version: fcb1aa5163b1ae4cf2864b688b08927aac51f51e
Version: fcb1aa5163b1ae4cf2864b688b08927aac51f51e
Version: fcb1aa5163b1ae4cf2864b688b08927aac51f51e
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/conntrack.c",
            "net/openvswitch/datapath.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9e79fdabd52cfce1a021640a81256878a2c516a2",
              "status": "affected",
              "version": "fcb1aa5163b1ae4cf2864b688b08927aac51f51e",
              "versionType": "git"
            },
            {
              "lessThan": "d91bfc64a4886102746e74d2c6f3a61e9a77fd7d",
              "status": "affected",
              "version": "fcb1aa5163b1ae4cf2864b688b08927aac51f51e",
              "versionType": "git"
            },
            {
              "lessThan": "1063ae07383c0ddc5bcce170260c143825846b03",
              "status": "affected",
              "version": "fcb1aa5163b1ae4cf2864b688b08927aac51f51e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/openvswitch/conntrack.c",
            "net/openvswitch/datapath.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.20",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.8",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"openvswitch: switch to per-action label counting in conntrack\"\n\nCurrently, ovs_ct_set_labels() is only called for confirmed conntrack\nentries (ct) within ovs_ct_commit(). However, if the conntrack entry\ndoes not have the labels_ext extension, attempting to allocate it in\novs_ct_get_conn_labels() for a confirmed entry triggers a warning in\nnf_ct_ext_add():\n\n  WARN_ON(nf_ct_is_confirmed(ct));\n\nThis happens when the conntrack entry is created externally before OVS\nincrements net-\u003ect.labels_used. The issue has become more likely since\ncommit fcb1aa5163b1 (\"openvswitch: switch to per-action label counting\nin conntrack\"), which changed to use per-action label counting and\nincrement net-\u003ect.labels_used when a flow with ct action is added.\n\nSince there\u2019s no straightforward way to fully resolve this issue at the\nmoment, this reverts the commit to avoid breaking existing use cases."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T07:25:46.303Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9e79fdabd52cfce1a021640a81256878a2c516a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/d91bfc64a4886102746e74d2c6f3a61e9a77fd7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1063ae07383c0ddc5bcce170260c143825846b03"
        }
      ],
      "title": "Revert \"openvswitch: switch to per-action label counting in conntrack\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21958",
    "datePublished": "2025-04-01T15:46:57.268Z",
    "dateReserved": "2024-12-29T08:45:45.791Z",
    "dateUpdated": "2025-05-04T07:25:46.303Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21958\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-04-01T16:15:27.010\",\"lastModified\":\"2025-04-01T20:26:01.990\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRevert \\\"openvswitch: switch to per-action label counting in conntrack\\\"\\n\\nCurrently, ovs_ct_set_labels() is only called for confirmed conntrack\\nentries (ct) within ovs_ct_commit(). However, if the conntrack entry\\ndoes not have the labels_ext extension, attempting to allocate it in\\novs_ct_get_conn_labels() for a confirmed entry triggers a warning in\\nnf_ct_ext_add():\\n\\n  WARN_ON(nf_ct_is_confirmed(ct));\\n\\nThis happens when the conntrack entry is created externally before OVS\\nincrements net-\u003ect.labels_used. The issue has become more likely since\\ncommit fcb1aa5163b1 (\\\"openvswitch: switch to per-action label counting\\nin conntrack\\\"), which changed to use per-action label counting and\\nincrement net-\u003ect.labels_used when a flow with ct action is added.\\n\\nSince there\u2019s no straightforward way to fully resolve this issue at the\\nmoment, this reverts the commit to avoid breaking existing use cases.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Revertir \\\"openvswitch: cambiar al conteo de etiquetas por acci\u00f3n en conntrack\\\". Actualmente, ovs_ct_set_labels() solo se llama para entradas de conntrack confirmadas (ct) dentro de ovs_ct_commit(). Sin embargo, si la entrada de conntrack no tiene la extensi\u00f3n labels_ext, al intentar asignarla en ovs_ct_get_conn_labels() para una entrada confirmada, se genera una advertencia en nf_ct_ext_add(): WARN_ON(nf_ct_is_confirmed(ct)); Esto ocurre cuando la entrada de conntrack se crea externamente antes de que OVS incremente net-\u0026gt;ct.labels_used. El problema se ha vuelto m\u00e1s frecuente desde el commit fcb1aa5163b1 (\\\"openvswitch: cambio al conteo de etiquetas por acci\u00f3n en conntrack\\\"), que cambi\u00f3 para usar el conteo de etiquetas por acci\u00f3n e incrementar net-\u0026gt;ct.labels_used al agregar un flujo con la acci\u00f3n ct. Dado que actualmente no existe una soluci\u00f3n directa para este problema, esta reversi\u00f3n de el commit evita la interrupci\u00f3n de los casos de uso existentes.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1063ae07383c0ddc5bcce170260c143825846b03\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9e79fdabd52cfce1a021640a81256878a2c516a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d91bfc64a4886102746e74d2c6f3a61e9a77fd7d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.