Medium 5.5Published Jan 19, 2025

CVE-2025-21648netfilter: conntrack: clamp maximum hashtable size to INT_MAX

Updated under an hour ago (Oct 28, 2026, 3:50 AM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See: 0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls") Note: hashtable resize is only possible from init_netns.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 before a965f7f0ea3ae61b9165bed619d5d6da02c75f80; from 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 before b1b2353d768f1b80cd7fe045a70adee576b9b338; from 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 before 5552b4fd44be3393b930434a7845d8d95a2a3c33; from 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 before d5807dd1328bbc86e059c5de80d1bbee9d58ca3d; from 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 before f559357d035877b9d0dcd273e0ff83e18e1d46aa; from 9cc1c73ad66610bffc80b691136ffc1e9a3b1a58 before b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.7.1 before 5.10.234; from 5.11 before 5.15.177; from 5.16 before 6.1.125; from 6.2 before 6.6.72; from 6.7 before 6.12.10; 4.7; 6.13; 6.13; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/a965f7f0ea3ae61b9165bed619d5d6da02c75f80	patch
https://git.kernel.org/stable/c/b1b2353d768f1b80cd7fe045a70adee576b9b338	patch
https://git.kernel.org/stable/c/5552b4fd44be3393b930434a7845d8d95a2a3c33	patch
https://git.kernel.org/stable/c/d5807dd1328bbc86e059c5de80d1bbee9d58ca3d	patch
https://git.kernel.org/stable/c/f559357d035877b9d0dcd273e0ff83e18e1d46aa	patch
https://git.kernel.org/stable/c/b541ba7d1f5a5b7b3e2e22dc9e40e18a7d6dbc13	patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.