In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_reject: don't leak dst refcount for loopback packets
recent patches to add a WARN() when replacing skb dst entry found an old bug:
WARNING: include/linux/skbuff.h:1165 skbdstcheckunset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skbdstset include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nfrejectfillskbdst+0x2a4/0x330 net/ipv4/netfilter/nfrejectipv4.c:234 [..] Call Trace: nfsendunreach+0x17b/0x6e0 net/ipv4/netfilter/nfrejectipv4.c:325 nftrejectineteval+0x4bc/0x690 net/netfilter/nftrejectinet.c:27 exprcallopseval net/netfilter/nftables_core.c:237 [inline] ..
This is because blamed commit forgot about loopback packets. Such packets already have a dstentry attached, even at PREROUTING stage.
Instead of checking hook just check if the skb already has a route attached to it.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38732.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38732.json"
[
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_send_unreach6"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8b503c06274ef3c6c1a107743f1ec0d0a53ef8",
"deprecated": false,
"digest": {
"function_hash": "293922884193426963828291940752083476284",
"length": 398.0
},
"id": "CVE-2025-38732-17628ed2",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv4/netfilter/nf_reject_ipv4.c",
"function": "nf_send_reset"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8b503c06274ef3c6c1a107743f1ec0d0a53ef8",
"deprecated": false,
"digest": {
"function_hash": "178042564180958967332036663619063694776",
"length": 1417.0
},
"id": "CVE-2025-38732-33c1c791",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51e8531371f90bee742c63775c9a568e5d6bf3c5",
"deprecated": false,
"digest": {
"line_hashes": [
"329241031704558651723330616673787571124",
"225694675847007847119971449976200569837",
"54786209448687165354685155600294341147",
"261646990613719166422840551429510574913",
"243356930441663163572365282058421367419",
"40790319383243579528171392116912498857",
"71388087217263519935279744881558854972",
"189235519409272008071622873290930147523",
"257922197065254167695959074673442412294"
],
"threshold": 0.9
},
"id": "CVE-2025-38732-4797b845",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_send_reset6"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8b503c06274ef3c6c1a107743f1ec0d0a53ef8",
"deprecated": false,
"digest": {
"function_hash": "152778738838969720009615559758973072307",
"length": 2204.0
},
"id": "CVE-2025-38732-80f3df89",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8b503c06274ef3c6c1a107743f1ec0d0a53ef8",
"deprecated": false,
"digest": {
"line_hashes": [
"329241031704558651723330616673787571124",
"225694675847007847119971449976200569837",
"54786209448687165354685155600294341147",
"261646990613719166422840551429510574913",
"243356930441663163572365282058421367419",
"40790319383243579528171392116912498857",
"71388087217263519935279744881558854972",
"189235519409272008071622873290930147523",
"257922197065254167695959074673442412294"
],
"threshold": 0.9
},
"id": "CVE-2025-38732-8c237fd6",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv4/netfilter/nf_reject_ipv4.c",
"function": "nf_send_unreach"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8b503c06274ef3c6c1a107743f1ec0d0a53ef8",
"deprecated": false,
"digest": {
"function_hash": "303040010840373881383344309706672884020",
"length": 522.0
},
"id": "CVE-2025-38732-90ed1a1c",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv4/netfilter/nf_reject_ipv4.c",
"function": "nf_send_unreach"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51e8531371f90bee742c63775c9a568e5d6bf3c5",
"deprecated": false,
"digest": {
"function_hash": "283272121669542151034357636887005323901",
"length": 554.0
},
"id": "CVE-2025-38732-983b0771",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv4/netfilter/nf_reject_ipv4.c",
"function": "nf_send_reset"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51e8531371f90bee742c63775c9a568e5d6bf3c5",
"deprecated": false,
"digest": {
"function_hash": "142572527132239973044063667760341445289",
"length": 1468.0
},
"id": "CVE-2025-38732-c2dfc6cd",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv4/netfilter/nf_reject_ipv4.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b8b503c06274ef3c6c1a107743f1ec0d0a53ef8",
"deprecated": false,
"digest": {
"line_hashes": [
"80904299101963577905236502896040814013",
"278291191000190672095218114739150053668",
"284074895952626118734377129956925320784",
"262440814941048018011418145084718464222",
"45456092959862187681449168311631304106",
"329212276848621402139737825384886224552",
"21775849897848858453879577578705649960",
"139194895584725706063402718714517409387",
"294818838740827619862281449601007408312",
"269153224828928845395175510692091920535"
],
"threshold": 0.9
},
"id": "CVE-2025-38732-e2e41064",
"signature_type": "Line"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_send_unreach6"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51e8531371f90bee742c63775c9a568e5d6bf3c5",
"deprecated": false,
"digest": {
"function_hash": "293922884193426963828291940752083476284",
"length": 398.0
},
"id": "CVE-2025-38732-e7b7e56f",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c",
"function": "nf_send_reset6"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51e8531371f90bee742c63775c9a568e5d6bf3c5",
"deprecated": false,
"digest": {
"function_hash": "53604014078195554682303476162060020842",
"length": 2211.0
},
"id": "CVE-2025-38732-f114386f",
"signature_type": "Function"
},
{
"signature_version": "v1",
"target": {
"file": "net/ipv4/netfilter/nf_reject_ipv4.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@51e8531371f90bee742c63775c9a568e5d6bf3c5",
"deprecated": false,
"digest": {
"line_hashes": [
"80904299101963577905236502896040814013",
"278291191000190672095218114739150053668",
"284074895952626118734377129956925320784",
"262440814941048018011418145084718464222",
"45456092959862187681449168311631304106",
"329212276848621402139737825384886224552",
"21775849897848858453879577578705649960",
"139194895584725706063402718714517409387",
"58702953631447541329373911388658877073",
"191561494691102598195467371977948179153"
],
"threshold": 0.9
},
"id": "CVE-2025-38732-ff390636",
"signature_type": "Line"
}
]