CVE-2025-71146

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71146", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:30:19.661Z", "datePublished": "2026-01-23T14:15:12.998Z", "dateUpdated": "2026-08-05T12:12:20.914Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:12:20.914Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conncount: fix leaked ct in error paths\n\nThere are some situations where ct might be leaked as error paths are\nskipping the refcounted check and return immediately. In order to solve\nit make sure that the check is always called."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - A remote attacker can trigger the vulnerable conncount path using inbound packets when a raw-table connlimit rule processes traffic before conntrack attachment.\nAC:L - The attacker can generate tracked flows and sustained packet pressure to induce the GFP_ATOMIC failure paths repeatedly; no race or condition fundamentally outside attacker influence is required.\nPR:N - Once connlimit is configured, unauthenticated inbound packets execute the match without requiring attacker credentials or capabilities.\nUI:N - Exploitation requires no action by another user.\nS:U - The leak affects conntrack and kernel resources within the same host security authority.\nC:N - The retained reference exposes no data and creates no memory-read primitive.\nI:N - The bug neither corrupts memory nor permits modification of kernel or user data.\nA:H - Leaked conntrack objects can permanently consume the per-netns conntrack count, eventually causing new connections to be dropped; they can also make namespace cleanup loop indefinitely waiting for the count to reach zero."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_conncount.c"], "versions": [{"version": "6e86f0eca857ee42787e30e9ec0b726aebfcae0a", "lessThan": "08fa37f4c8c59c294e9c18fea2d083ee94074e5a", "status": "affected", "versionType": "git"}, {"version": "b160895d6bc9690459b16ef87799c9bd456af3ec", "lessThan": "e1ac8dce3a893641bef224ad057932f142b8a36f", "status": "affected", "versionType": "git"}, {"version": "8d5a2c94c24dcc226863a7c2b5034750370c2189", "lessThan": "f381a33f34dda9e4023e38ba68c943bca83245e9", "status": "affected", "versionType": "git"}, {"version": "da9f247fb5efcd5a2730cdc989291b383c439e10", "lessThan": "325eb61bb30790ea27782203a17b007ce1754a67", "status": "affected", "versionType": "git"}, {"version": "3558faee8aace3541189c3a2ca45c7e85e144b44", "lessThan": "0b88be7211d21a0d68bb1e56dc805944e3654d6f", "status": "affected", "versionType": "git"}, {"version": "f6904ed15ed1a188543057e3cb0d02daa80edfc9", "lessThan": "4bd2b89f4028f250dd1c1625eb3da1979b04a5e8", "status": "affected", "versionType": "git"}, {"version": "be102eb6a0e7c03db00e50540622f4e43b2d2844", "lessThan": "2e2a720766886190a6d35c116794693aabd332b6", "status": "affected", "versionType": "git"}, {"version": "8c2da7330214ce30f8333d1799a27ed0a9418f07", "status": "affected", "versionType": "git"}, {"version": "6.17.13", "lessThan": "6.18", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_conncount.c"], "versions": [{"version": "6.12.63", "lessThan": "6.12.64", "status": "affected", "versionType": "semver"}, {"version": "6.18.2", "lessThan": "6.18.3", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.63", "versionEndExcluding": "6.12.64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.2", "versionEndExcluding": "6.18.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17.13"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/08fa37f4c8c59c294e9c18fea2d083ee94074e5a"}, {"url": "https://git.kernel.org/stable/c/e1ac8dce3a893641bef224ad057932f142b8a36f"}, {"url": "https://git.kernel.org/stable/c/f381a33f34dda9e4023e38ba68c943bca83245e9"}, {"url": "https://git.kernel.org/stable/c/325eb61bb30790ea27782203a17b007ce1754a67"}, {"url": "https://git.kernel.org/stable/c/0b88be7211d21a0d68bb1e56dc805944e3654d6f"}, {"url": "https://git.kernel.org/stable/c/4bd2b89f4028f250dd1c1625eb3da1979b04a5e8"}, {"url": "https://git.kernel.org/stable/c/2e2a720766886190a6d35c116794693aabd332b6"}], "title": "netfilter: nf_conncount: fix leaked ct in error paths", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nf_conncount.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "08fa37f4c8c59c294e9c18fea2d083ee94074e5a", "status": "affected", "version": "6e86f0eca857ee42787e30e9ec0b726aebfcae0a", "versionType": "git"}, {"lessThan": "e1ac8dce3a893641bef224ad057932f142b8a36f", "status": "affected", "version": "b160895d6bc9690459b16ef87799c9bd456af3ec", "versionType": "git"}, {"lessThan": "f381a33f34dda9e4023e38ba68c943bca83245e9", "status": "affected", "version": "8d5a2c94c24dcc226863a7c2b5034750370c2189", "versionType": "git"}, {"lessThan": "325eb61bb30790ea27782203a17b007ce1754a67", "status": "affected", "version": "da9f247fb5efcd5a2730cdc989291b383c439e10", "versionType": "git"}, {"lessThan": "0b88be7211d21a0d68bb1e56dc805944e3654d6f", "status": "affected", "version": "3558faee8aace3541189c3a2ca45c7e85e144b44", "versionType": "git"}, {"lessThan": "4bd2b89f4028f250dd1c1625eb3da1979b04a5e8", "status": "affected", "version": "f6904ed15ed1a188543057e3cb0d02daa80edfc9", "versionType": "git"}, {"lessThan": "2e2a720766886190a6d35c116794693aabd332b6", "status": "affected", "version": "be102eb6a0e7c03db00e50540622f4e43b2d2844", "versionType": "git"}, {"status": "affected", "version": "8c2da7330214ce30f8333d1799a27ed0a9418f07", "versionType": "git"}, {"lessThan": "6.18", "status": "affected", "version": "6.17.13", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nf_conncount.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6.12.64", "status": "affected", "version": "6.12.63", "versionType": "semver"}, {"lessThan": "6.18.3", "status": "affected", "version": "6.18.2", "versionType": "semver"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7C298528-1754-41BD-B4E9-84A37AB7BA32", "versionEndExcluding": "6.18", "versionStartIncluding": "6.17.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12.63:*:*:*:*:*:*:*", "matchCriteriaId": "7984A97B-8D26-49DE-B98A-80F987DC6ECE", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18.2:*:*:*:*:*:*:*", "matchCriteriaId": "3F3959F8-92E0-4D2C-B5DA-B3BB4BE80113", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conncount: fix leaked ct in error paths\n\nThere are some situations where ct might be leaked as error paths are\nskipping the refcounted check and return immediately. In order to solve\nit make sure that the check is always called."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: nf_conncount: correcci\u00f3n de 'ct' filtrado en rutas de error\n\nExisten algunas situaciones en las que 'ct' podr\u00eda filtrarse, ya que las rutas de error est\u00e1n omitiendo la verificaci\u00f3n de conteo de referencias y retornan inmediatamente. Para resolverlo, hay que asegurarse de que la verificaci\u00f3n siempre sea llamada."}], "id": "CVE-2025-71146", "lastModified": "2026-07-30T06:24:54.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-01-23T15:16:05.230", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/08fa37f4c8c59c294e9c18fea2d083ee94074e5a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0b88be7211d21a0d68bb1e56dc805944e3654d6f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2e2a720766886190a6d35c116794693aabd332b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/325eb61bb30790ea27782203a17b007ce1754a67"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4bd2b89f4028f250dd1c1625eb3da1979b04a5e8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e1ac8dce3a893641bef224ad057932f142b8a36f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f381a33f34dda9e4023e38ba68c943bca83245e9"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: netfilter: nf_conncount: fix leaked ct in error paths", "id": "2432361", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432361"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2025-71146", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-71146\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71146\nhttps://lore.kernel.org/linux-cve-announce/2026012325-CVE-2025-71146-96cf@gregkh/T"], "threat_severity": "Moderate"}

{}