In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconncount: Fully initialize struct nfconncounttuple in inserttree()
Since commit b36e4523d4d5 ("netfilter: nfconncount: fix garbage
collection confirm race"), cpu and jiffies32 were introduced to
the struct nfconncount_tuple.
The commit made nfconncountadd() initialize conn->cpu and
conn->jiffies32 when allocating the struct.
In contrast, count_tree() was not changed to initialize them.
By commit 34848d5c896e ("netfilter: nfconncount: Split insert and
traversal"), counttree() was split and the relevant allocation
code now resides in inserttree().
Initialize conn->cpu and conn->jiffies32 in inserttree().
BUG: KMSAN: uninit-value in findorevict net/netfilter/nfconncount.c:117 [inline] BUG: KMSAN: uninit-value in _nfconncountadd+0xd9c/0x2850 net/netfilter/nfconncount.c:143 findorevict net/netfilter/nfconncount.c:117 [inline] _nfconncountadd+0xd9c/0x2850 net/netfilter/nfconncount.c:143 counttree net/netfilter/nfconncount.c:438 [inline] nfconncountcount+0x82f/0x1e80 net/netfilter/nfconncount.c:521 connlimitmt+0x7f6/0xbd0 net/netfilter/xtconnlimit.c:72 _nftmatcheval net/netfilter/nftcompat.c:403 [inline] nftmatcheval+0x1a5/0x300 net/netfilter/nftcompat.c:433 exprcallopseval net/netfilter/nftablescore.c:240 [inline] nftdochain+0x426/0x2290 net/netfilter/nftablescore.c:288 nftdochainipv4+0x1a5/0x230 net/netfilter/nftchainfilter.c:23 nfhookentryhookfn include/linux/netfilter.h:154 [inline] nfhookslow+0xf4/0x400 net/netfilter/core.c:626 nfhookslowlist+0x24d/0x860 net/netfilter/core.c:663 NFHOOKLIST include/linux/netfilter.h:350 [inline] ipsublistrcv+0x17b7/0x17f0 net/ipv4/ipinput.c:633 iplistrcv+0x9ef/0xa40 net/ipv4/ipinput.c:669 _netifreceiveskblistptype net/core/dev.c:5936 [inline] _netifreceiveskblistcore+0x15c5/0x1670 net/core/dev.c:5983 _netifreceiveskblist net/core/dev.c:6035 [inline] netifreceiveskblistinternal+0x1085/0x1700 net/core/dev.c:6126 netifreceiveskblist+0x5a/0x460 net/core/dev.c:6178 xdprecvframes net/bpf/testrun.c:280 [inline] xdptestrunbatch net/bpf/testrun.c:361 [inline] bpftestrunxdplive+0x2e86/0x3480 net/bpf/testrun.c:390 bpfprogtestrunxdp+0xf1d/0x1ae0 net/bpf/testrun.c:1316 bpfprogtestrun+0x5e5/0xa30 kernel/bpf/syscall.c:4407 _sysbpf+0x6aa/0xd90 kernel/bpf/syscall.c:5813 _dosysbpf kernel/bpf/syscall.c:5902 [inline] _sesysbpf kernel/bpf/syscall.c:5900 [inline] _ia32sysbpf+0xa0/0xe0 kernel/bpf/syscall.c:5900 ia32syscall+0x394d/0x4180 arch/x86/include/generated/asm/syscalls32.h:358 dosyscall32irqson arch/x86/entry/common.c:165 [inline] _dofastsyscall32+0xb0/0x110 arch/x86/entry/common.c:387 dofastsyscall32+0x38/0x80 arch/x86/entry/common.c:412 doSYSENTER32+0x1f/0x30 arch/x86/entry/common.c:450 entrySYSENTERcompatafterhwframe+0x84/0x8e
Uninit was created at: slabpostallochook mm/slub.c:4121 [inline] slaballocnode mm/slub.c:4164 [inline] kmemcacheallocnoprof+0x915/0xe10 mm/slub.c:4171 inserttree net/netfilter/nfconncount.c:372 [inline] counttree net/netfilter/nfconncount.c:450 [inline] nfconncountcount+0x1415/0x1e80 net/netfilter/nfconncount.c:521 connlimitmt+0x7f6/0xbd0 net/netfilter/xtconnlimit.c:72 _nftmatcheval net/netfilter/nftcompat.c:403 [inline] nftmatcheval+0x1a5/0x300 net/netfilter/nftcompat.c:433 exprcallopseval net/netfilter/nftablescore.c:240 [inline] nftdochain+0x426/0x2290 net/netfilter/nftablescore.c:288 nftdochainipv4+0x1a5/0x230 net/netfilter/nftchainfilter.c:23 nfhookentryhookfn include/linux/netfilter.h:154 [inline] nfhookslow+0xf4/0x400 net/netfilter/core.c:626 nfhookslowlist+0x24d/0x860 net/netfilter/core.c:663 NFHOOKLIST include/linux/netfilter.h:350 [inline] ipsublistrcv+0x17b7/0x17f0 net/ipv4/ipinput.c:633 iplist_rcv+0x9ef/0xa40 net/ip ---truncated---
[
{
"id": "CVE-2025-21959-07716236",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8544a5a97bee3674e7cd6bf0f3a4af517fa9146",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"20710841846540767179545108105323340358",
"188731272336606348566723330773864634424",
"142596472250596893051450955534065133388",
"119125052408062948884607609947721245907"
]
},
"signature_type": "Line",
"target": {
"file": "net/netfilter/nf_conncount.c"
}
},
{
"id": "CVE-2025-21959-28547cf0",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8544a5a97bee3674e7cd6bf0f3a4af517fa9146",
"signature_version": "v1",
"digest": {
"function_hash": "224512651117280055567963934873369598041",
"length": 1712.0
},
"signature_type": "Function",
"target": {
"file": "net/netfilter/nf_conncount.c",
"function": "insert_tree"
}
},
{
"id": "CVE-2025-21959-5fcd7b30",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a154ce766b995494e88d8d117fa82cc6b73dd87",
"signature_version": "v1",
"digest": {
"function_hash": "224512651117280055567963934873369598041",
"length": 1712.0
},
"signature_type": "Function",
"target": {
"file": "net/netfilter/nf_conncount.c",
"function": "insert_tree"
}
},
{
"id": "CVE-2025-21959-65b6d059",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a154ce766b995494e88d8d117fa82cc6b73dd87",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"20710841846540767179545108105323340358",
"188731272336606348566723330773864634424",
"142596472250596893051450955534065133388",
"119125052408062948884607609947721245907"
]
},
"signature_type": "Line",
"target": {
"file": "net/netfilter/nf_conncount.c"
}
},
{
"id": "CVE-2025-21959-69587192",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db1e0c0856821c59a32ea3af79476bf20a6beeb2",
"signature_version": "v1",
"digest": {
"function_hash": "224512651117280055567963934873369598041",
"length": 1712.0
},
"signature_type": "Function",
"target": {
"file": "net/netfilter/nf_conncount.c",
"function": "insert_tree"
}
},
{
"id": "CVE-2025-21959-7ab88b73",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@db1e0c0856821c59a32ea3af79476bf20a6beeb2",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"20710841846540767179545108105323340358",
"188731272336606348566723330773864634424",
"142596472250596893051450955534065133388",
"119125052408062948884607609947721245907"
]
},
"signature_type": "Line",
"target": {
"file": "net/netfilter/nf_conncount.c"
}
},
{
"id": "CVE-2025-21959-9d295bfb",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc",
"signature_version": "v1",
"digest": {
"function_hash": "224512651117280055567963934873369598041",
"length": 1712.0
},
"signature_type": "Function",
"target": {
"file": "net/netfilter/nf_conncount.c",
"function": "insert_tree"
}
},
{
"id": "CVE-2025-21959-d977cc4e",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2db5baaf047a7c8d6ed5e2cc657b7854e155b7fc",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"20710841846540767179545108105323340358",
"188731272336606348566723330773864634424",
"142596472250596893051450955534065133388",
"119125052408062948884607609947721245907"
]
},
"signature_type": "Line",
"target": {
"file": "net/netfilter/nf_conncount.c"
}
}
]