CVE-2025-21648

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: clamp maximum hashtable size to INT_MAX

Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof() when resizing hashtable because __GFP_NOWARN is unset. See:

0708a0afe291 ("mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls")

Note: hashtable resize is only possible from init_netns.

This vulnerability is rated as having Moderate impact on Red Hat Enterprise Linux because triggering the condition requires privileged administrative access within the initial network namespace to adjust connection tracking parameters. Modifying the table capacity to an excessive value triggers an unhandled memory allocation warning, leading to resource allocation failure or system log spam without enabling privilege escalation. Systems operating under default configurations are not exposed unless an administrator explicitly configures an oversized bucket threshold.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.