CVE-2025-21958 Revert "openvswitch: switch to per-action label counting in conntrack"
A race condition in Open vSwitch conntrack label handling can trigger a kernel warning, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-21958?
CVE-2025-21958 is a high-severity vulnerability in Linux kernel, published on 1 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Revert "openvswitch: switch to per-action label counting in conntrack"
Currently, ovs_ct_set_labels() is only called for confirmed conntrack entries (ct) within ovs_ct_commit(). However, if the conntrack entry does not have the labels_ext extension, attempting to allocate it in ovs_ct_get_conn_labels() for a confirmed entry triggers a warning in nf_ct_ext_add():
WARN_ON(nf_ct_is_confirmed(ct));
This happens when the conntrack entry is created externally before OVS increments net->ct.labels_used. The issue has become more likely since commit fcb1aa5163b1 ("openvswitch: switch to per-action label counting in conntrack"), which changed to use per-action label counting and increment net->ct.labels_used when a flow with ct action is added.
Since there’s no straightforward way to fully resolve this issue at the moment, this reverts the commit to avoid breaking existing use cases.
Weakness: CWE-367
Which versions are affected by CVE-2025-21958?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-21958?
Apply the vendor's patch.
Is CVE-2025-21958 being exploited?
There is no known exploitation of CVE-2025-21958 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-21958, DEBIAN-CVE-2025-21958, GHSA-jx6v-7wmg-pq67, UBUNTU-CVE-2025-21958.