CVE-2025-22110

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: Initialize ctx to avoid memory allocation error

It is possible that ctx in nfqnl_build_packet_message() could be used before it is properly initialize, which is only initialized by nfqnl_get_sk_secctx().

This patch corrects this problem by initializing the lsmctx to a safe value when it is declared.

This is similar to the commit 35fcac7a7c25 ("audit: Initialize lsmctx to avoid memory allocation error").

This vulnerability is rated as Moderate severity because triggering the flaw requires local access to interact with netfilter queue subsystem interfaces, confining the blast radius to a local denial of service or limited uninitialized memory read rather than remote system compromise. In standard Red Hat Enterprise Linux deployments, nfnetlink queue packet inspection is not enabled by default and requires administrative firewall rules. Furthermore, the underlying code modification that introduced this flaw is absent from supported Red Hat Enterprise Linux releases.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.