CVE-2025-40206: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's netfilter component was discovered that affects the nft_objref functionality. The issue was identified and published on November 12, 2025, and involves the validation of objref and objrefmap expressions, particularly when referencing synproxy stateful objects from the OUTPUT hook (NVD CVE).

The vulnerability occurs when referencing a synproxy stateful object from the OUTPUT hook, which causes a kernel crash due to infinite recursive calls. The issue manifests as a stack guard page hit at specific memory addresses, triggering a kernel BUG condition. The call trace involves multiple functions including _findrrleaf, fib6tablelookup, ip6pol_route, and several others in the networking stack (NVD CVE).

When exploited, this vulnerability results in a kernel crash, effectively causing a denial of service condition on the affected system. The crash occurs specifically when attempting to use synproxy objects in conjunction with the OUTPUT hook in netfilter rules (NVD CVE).

The issue has been resolved by implementing objref and objrefmap expression validate functions. The fix now produces an error message when attempting to reference a synproxy object in the OUTPUT hook, stating 'Error: Could not process rule: Operation not supported' instead of causing a kernel crash (NVD CVE).