CVE-2025-38201: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38201 is a vulnerability in the Linux kernel's netfilter subsystem, specifically in the nft_set_pipapo module, where the maximum map bucket size is not properly clamped to INT_MAX. This flaw can trigger a WARN_ON_ONCE in __kvmalloc_node_noprof() during hashtable resizing operations when __GFP_NOWARN is unset. The vulnerability was disclosed on July 4, 2025, and affects Linux kernel versions 5.6 through 6.12.34 and 6.13 through 6.15.3. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-20) in the nft_set_pipapo netfilter module, where the maximum map bucket size is not bounded to INT_MAX before being used in memory allocation during hashtable resizing. When a local attacker triggers a resize operation with an oversized bucket count, the kernel's __kvmalloc_node_noprof() function fires a WARN_ON_ONCE because __GFP_NOWARN is not set, potentially leading to kernel memory manipulation. The fix mirrors a prior patch for a similar issue in the conntrack subsystem (commit b541ba7d1f5a). The attack vector is local with low privileges required and no user interaction needed (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation by a local low-privileged attacker can result in high confidentiality, integrity, and availability impacts, including potential kernel memory manipulation. The vulnerability could allow an attacker to destabilize the kernel during netfilter hashtable resizing, potentially leading to denial of service or privilege escalation on affected systems. All Linux systems running kernel versions 5.6 through 6.12.34 or 6.13 through 6.15.3 with netfilter/nftables enabled are within scope (Red Hat Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term (Red Hat Advisory).

• Logs: Kernel log entries containing WARN_ON_ONCE messages referencing __kvmalloc_node_noprof or nft_set_pipapo during netfilter hashtable resize operations (check dmesg or /var/log/kern.log).
• Process: Unusual local processes interacting with nftables (e.g., repeated nft commands manipulating set/map sizes) from low-privileged user accounts.
• System: Unexpected kernel warnings or panics correlated with nftables rule modifications on systems running affected kernel versions (5.6–6.12.34 or 6.13–6.15.3).

Update the Linux kernel to version 6.12.35 or later (for the 6.12 stable branch) or 6.15.4 or later (for the 6.15 branch). Patches have also been backported to multiple stable kernel branches via upstream commits: 0ab3de047808, b85e3367a571, d2768016f091, 1fe27f979440, 4abccfb61f42, 80417057ac60, and df524a68d902. Major distributions including Ubuntu (USN-7833-x, USN-7856-1, USN-8278-x, USN-8289-x, USN-8296-x), SUSE, openSUSE, Debian (DSA-6163-1, DLA-4498-1), and Amazon Linux 2 have released updated kernel packages. As a workaround where patching is not immediately possible, restrict local user privileges and limit access to nftables configuration (Red Hat Advisory, Red Hat Bugzilla).