VulnerabilityPublished 5 Sep 2025Updated 5 Nov 2026

CVE-2025-38732: Linux kernel · netfilter: nf_reject: don't leak dst refcount for loopback packets

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in b32e1590a8d22cf7d7f965e46d5576051acf8e42 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 21:48 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in b32e1590a8d22cf7d7f965e46d5576051acf8e42, b7a885ba25960c91db237c3f83b4285156789bce, a0a3ace2a57887dac1e7c9a724846040c3e31868 +4

Exploitation evidence

Disclosed: evidence found.
CVE published 5 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ f53b9b0bdc59c0823679f2e3214e0d538f5951b9, < b32e1590a8d22cf7d7f965e46d5576051acf8e42	Fixed in b32e1590a8d22cf7d7f965e46d5576051acf8e42
LinuxLinux	Affected ≥ f53b9b0bdc59c0823679f2e3214e0d538f5951b9, < b7a885ba25960c91db237c3f83b4285156789bce	Fixed in b7a885ba25960c91db237c3f83b4285156789bce
LinuxLinux	Affected ≥ f53b9b0bdc59c0823679f2e3214e0d538f5951b9, < a0a3ace2a57887dac1e7c9a724846040c3e31868	Fixed in a0a3ace2a57887dac1e7c9a724846040c3e31868
LinuxLinux	Affected ≥ f53b9b0bdc59c0823679f2e3214e0d538f5951b9, < 91a79b792204313153e1bdbbe5acbfc28903b3a5	Fixed in 91a79b792204313153e1bdbbe5acbfc28903b3a5
LinuxLinux	Affected ≥ f53b9b0bdc59c0823679f2e3214e0d538f5951b9, < 82ef97abf22790182f7d433c74960dfd61b99c33	Fixed in 82ef97abf22790182f7d433c74960dfd61b99c33
LinuxLinux	Affected ≥ f53b9b0bdc59c0823679f2e3214e0d538f5951b9, < 51e8531371f90bee742c63775c9a568e5d6bf3c5	Fixed in 51e8531371f90bee742c63775c9a568e5d6bf3c5

AI-suggested

This issue has been fixed in the Linux kernel versions identified by the commits listed in establishedFacts.fixedVersions. Users should update their Linux kernel to a version that includes these fixes to prevent the dst refcount leak. No additional mitigation steps are indicated.

Description

A vulnerability in the Linux kernel's netfilter subsystem (nf_reject) could cause a reference count leak for destination entries (dst refcount) when handling loopback packets. This issue arises because loopback packets already have a dst_entry attached even at the PRE_ROUTING stage, and the previous code did not properly account for this, leading to incorrect reference counting.

Impact

The vulnerability could lead to resource leaks in the kernel due to improper reference counting of destination entries for loopback packets. This may degrade system stability or performance over time but does not directly indicate privilege escalation or remote code execution.

Summary

CVE-2025-38732 addresses a flaw in the Linux kernel netfilter component nf_reject where the dst refcount for loopback packets could be leaked. The problem was introduced by recent patches that added warnings when replacing skb dst entries but failed to consider that loopback packets already have a dst_entry attached early in the packet processing. The fix involves checking if the skb already has a route attached rather than relying on the hook to avoid leaking the dst refcount.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 21:48 UTC

Technical details

References

Community reviews

Related threats