In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_reject: don't leak dst refcount for loopback packets
recent patches to add a WARN() when replacing skb dst entry found an old bug:
WARNING: include/linux/skbuff.h:1165 skbdstcheckunset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skbdstset include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nfrejectfillskbdst+0x2a4/0x330 net/ipv4/netfilter/nfrejectipv4.c:234 [..] Call Trace: nfsendunreach+0x17b/0x6e0 net/ipv4/netfilter/nfrejectipv4.c:325 nftrejectineteval+0x4bc/0x690 net/netfilter/nftrejectinet.c:27 exprcallopseval net/netfilter/nftables_core.c:237 [inline] ..
This is because blamed commit forgot about loopback packets. Such packets already have a dstentry attached, even at PREROUTING stage.
Instead of checking hook just check if the skb already has a route attached to it.
[
{
"id": "CVE-2025-38732-191fccb0",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "nf_send_reset6",
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91a79b792204313153e1bdbbe5acbfc28903b3a5",
"digest": {
"length": 2204.0,
"function_hash": "23865319802589707076088554075964812891"
},
"deprecated": false
},
{
"id": "CVE-2025-38732-47bd1a8d",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/ipv4/netfilter/nf_reject_ipv4.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0a3ace2a57887dac1e7c9a724846040c3e31868",
"digest": {
"line_hashes": [
"80904299101963577905236502896040814013",
"278291191000190672095218114739150053668",
"284074895952626118734377129956925320784",
"262440814941048018011418145084718464222",
"45456092959862187681449168311631304106",
"329212276848621402139737825384886224552",
"21775849897848858453879577578705649960",
"139194895584725706063402718714517409387",
"58702953631447541329373911388658877073",
"191561494691102598195467371977948179153"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-38732-59469033",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "nf_send_unreach",
"file": "net/ipv4/netfilter/nf_reject_ipv4.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0a3ace2a57887dac1e7c9a724846040c3e31868",
"digest": {
"length": 554.0,
"function_hash": "283272121669542151034357636887005323901"
},
"deprecated": false
},
{
"id": "CVE-2025-38732-923790d8",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0a3ace2a57887dac1e7c9a724846040c3e31868",
"digest": {
"line_hashes": [
"329241031704558651723330616673787571124",
"225694675847007847119971449976200569837",
"54786209448687165354685155600294341147",
"261646990613719166422840551429510574913",
"243356930441663163572365282058421367419",
"40790319383243579528171392116912498857",
"71388087217263519935279744881558854972",
"189235519409272008071622873290930147523",
"257922197065254167695959074673442412294"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-38732-a889158f",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "nf_send_unreach6",
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0a3ace2a57887dac1e7c9a724846040c3e31868",
"digest": {
"length": 398.0,
"function_hash": "293922884193426963828291940752083476284"
},
"deprecated": false
},
{
"id": "CVE-2025-38732-b24b7b2a",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "nf_send_reset6",
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0a3ace2a57887dac1e7c9a724846040c3e31868",
"digest": {
"length": 2211.0,
"function_hash": "53604014078195554682303476162060020842"
},
"deprecated": false
},
{
"id": "CVE-2025-38732-b44f08d9",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "nf_send_unreach6",
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91a79b792204313153e1bdbbe5acbfc28903b3a5",
"digest": {
"length": 398.0,
"function_hash": "293922884193426963828291940752083476284"
},
"deprecated": false
},
{
"id": "CVE-2025-38732-b6cdb734",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/ipv6/netfilter/nf_reject_ipv6.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91a79b792204313153e1bdbbe5acbfc28903b3a5",
"digest": {
"line_hashes": [
"329241031704558651723330616673787571124",
"225694675847007847119971449976200569837",
"54786209448687165354685155600294341147",
"261646990613719166422840551429510574913",
"243356930441663163572365282058421367419",
"40790319383243579528171392116912498857",
"71388087217263519935279744881558854972",
"189235519409272008071622873290930147523",
"257922197065254167695959074673442412294"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-38732-cd142b2b",
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "net/ipv4/netfilter/nf_reject_ipv4.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91a79b792204313153e1bdbbe5acbfc28903b3a5",
"digest": {
"line_hashes": [
"80904299101963577905236502896040814013",
"278291191000190672095218114739150053668",
"284074895952626118734377129956925320784",
"262440814941048018011418145084718464222",
"45456092959862187681449168311631304106",
"329212276848621402139737825384886224552",
"21775849897848858453879577578705649960",
"139194895584725706063402718714517409387",
"58702953631447541329373911388658877073",
"191561494691102598195467371977948179153"
],
"threshold": 0.9
},
"deprecated": false
},
{
"id": "CVE-2025-38732-d5627e18",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "nf_send_unreach",
"file": "net/ipv4/netfilter/nf_reject_ipv4.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91a79b792204313153e1bdbbe5acbfc28903b3a5",
"digest": {
"length": 554.0,
"function_hash": "283272121669542151034357636887005323901"
},
"deprecated": false
},
{
"id": "CVE-2025-38732-df8e0108",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "nf_send_reset",
"file": "net/ipv4/netfilter/nf_reject_ipv4.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91a79b792204313153e1bdbbe5acbfc28903b3a5",
"digest": {
"length": 1468.0,
"function_hash": "142572527132239973044063667760341445289"
},
"deprecated": false
},
{
"id": "CVE-2025-38732-e8446571",
"signature_type": "Function",
"signature_version": "v1",
"target": {
"function": "nf_send_reset",
"file": "net/ipv4/netfilter/nf_reject_ipv4.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0a3ace2a57887dac1e7c9a724846040c3e31868",
"digest": {
"length": 1468.0,
"function_hash": "142572527132239973044063667760341445289"
},
"deprecated": false
}
]