In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a… (CVE-2025-40206)
A vulnerability in the Linux kernel's netfilter nft_objref component allows referencing a synproxy stateful object from the OUTPUT hook, causing a kernel crash due to infinite recursive calls. This issue has been resolved by implementing validation functions for objref and objrefmap expressions, specifically for the NFT_OBJECT_SYNPROXY type. Attempts to reference a synproxy object in the OUTPUT hook now result in an error preventing the crash.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2025-40206 involves the netfilter nft_objref module where referencing a synproxy stateful object from the OUTPUT hook triggers infinite recursive calls leading to a kernel crash. The fix introduces validation for objref and objrefmap expressions, particularly for the NFT_OBJECT_SYNPROXY type, preventing unsupported operations that caused the crash. Post-fix, nftables rejects rules that attempt to reference synproxy objects in the OUTPUT hook with an explicit error message.
Potential Impact
Exploitation of this vulnerability causes a denial of service by crashing the kernel due to infinite recursion when a synproxy object is referenced from the OUTPUT hook. This results in complete system disruption with high confidentiality, integrity, and availability impact as indicated by the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that validation functions have been implemented to prevent the crash, and nftables now rejects unsupported synproxy references. Users should monitor vendor advisories for official patches or updates and avoid referencing synproxy objects from the OUTPUT hook until a fix is applied.
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a… (CVE-2025-40206)
Description
A vulnerability in the Linux kernel's netfilter nft_objref component allows referencing a synproxy stateful object from the OUTPUT hook, causing a kernel crash due to infinite recursive calls. This issue has been resolved by implementing validation functions for objref and objrefmap expressions, specifically for the NFT_OBJECT_SYNPROXY type. Attempts to reference a synproxy object in the OUTPUT hook now result in an error preventing the crash.
CVSS v3.1
Score 7.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2025-40206 involves the netfilter nft_objref module where referencing a synproxy stateful object from the OUTPUT hook triggers infinite recursive calls leading to a kernel crash. The fix introduces validation for objref and objrefmap expressions, particularly for the NFT_OBJECT_SYNPROXY type, preventing unsupported operations that caused the crash. Post-fix, nftables rejects rules that attempt to reference synproxy objects in the OUTPUT hook with an explicit error message.
Potential Impact
Exploitation of this vulnerability causes a denial of service by crashing the kernel due to infinite recursion when a synproxy object is referenced from the OUTPUT hook. This results in complete system disruption with high confidentiality, integrity, and availability impact as indicated by the CVSS vector.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability description indicates that validation functions have been implemented to prevent the crash, and nftables now rejects unsupported synproxy references. Users should monitor vendor advisories for official patches or updates and avoid referencing synproxy objects from the OUTPUT hook until a fix is applied.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-3xw5-26jc-pqjh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2025-40206"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a6b72d69c2644c7f847a898
Added to database: 07/30/2026, 15:50:46 UTC
Last enriched: 07/30/2026, 16:53:17 UTC
Last updated: 09/10/2026, 19:26:53 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.