CVE-2025-39764: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability was discovered in the Linux kernel's netfilter component, specifically in the ctnetlink expectation dumpers functionality. The issue was disclosed on September 11, 2025, and affects the refcounting mechanism in the expectation dumpers (NVD).

The vulnerability stems from a refcounting issue in the netfilter's ctnetlink expectation dumpers. When attempting to increment the refcount using refcount_inc_not_zero(&exp->use), there exists a race condition where exp could equal last, resulting in a double-increment of the refcount. This behavior follows the same pattern as a previously resolved issue in the conntrack dumper (NVD).

The primary impact of this vulnerability is a potential memory leak in the Linux kernel due to the double-increment of refcounts. This could lead to resource exhaustion over time, potentially affecting system stability (NVD).

The vulnerability has been resolved by modifying the refcounting mechanism in expectation dumpers. Instead of keeping the expectation object alive via refcount, the fix implements a cookie value system that serves as a skip hint for dump resumption (NVD).