LiveActive security incident?Get immediate response
CVE Record

CVE-2025-40206: netfilter: nft_objref: validate objref and objrefmap expressions

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace: __find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 nft_synproxy_do_eval+0x263/0x310 nft_do_chain+0x5a8/0x5f0 [nf_tables nft_do_chain_inet+0x98/0x110 nf_hook_slow+0x43/0xc0 __ip6_local_out+0xf0/0x170 ip6_local_out+0x17/0x70 synproxy_send_tcp_ipv6+0x1a2/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 [...] Implement objref and objrefmap expression validate functions. Currently, only NFT_OBJECT_SYNPROXY object type requires validation. This will also handle a jump to a chain using a synproxy object from the OUTPUT hook. Now when trying to reference a synproxy object in the OUTPUT hook, nft will produce the following error: synproxy_crash.nft: Error: Could not process rule: Operation not supported synproxy name mysynproxy ^^^^^^^^^^^^^^^^^^^^^^^^

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A local user who can manage affected nftables rules may trigger a Linux kernel crash by referencing a SYNPROXY object from an OUTPUT hook. This can disrupt the host and its workloads. The supplied evidence demonstrates denial of service, not confirmed data theft or system takeover.

Executive priority

Treat as a high-priority availability risk on exposed multi-user or shared Linux hosts. Accelerate patching where untrusted local users can influence nftables. For other systems, schedule prompt vendor-approved kernel updates after confirming applicability.

Technical view

Missing validation in nft_objref and nft_objrefmap allowed a SYNPROXY stateful object to be reached from an OUTPUT hook, directly or through a chain jump. IPv6 SYNPROXY processing could then recurse through local output routing until exhausting the kernel stack. The fix adds validation and rejects the unsupported rule.

Likely exposure

Exposure is limited to affected Linux kernels and actors able to install or alter the relevant nftables configuration locally. Systems using nftables SYNPROXY objects are the clearest priority. The supplied version data is ambiguous, so confirm affected and fixed releases with the operating-system vendor.

Exploitation context

The CVSS 3.1 score is 7.8, with local access, low complexity, low privileges, and no user interaction. The source bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. The demonstrated outcome is a kernel crash caused by infinite recursion.

Researcher notes

The reported path involves IPv6 local output, SYNPROXY evaluation, routing, and repeated re-entry until stack exhaustion. Review both direct object references and jumps into chains containing SYNPROXY objects. The source states only NFT_OBJECT_SYNPROXY currently requires this validation. Practical confidentiality or integrity impact is not demonstrated by the supplied evidence.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable cited validation fix.
  • Until updated, avoid SYNPROXY object references reachable from nftables OUTPUT hooks.
  • Review distribution security guidance for exact affected and corrected kernel package versions.
  • Prioritize shared hosts where local users can manage network namespaces or nftables rules.

Validation and detection

  • Record each host's running kernel release and compare it with vendor advisories.
  • Verify the installed kernel includes the applicable upstream stable fix.
  • Inspect nftables configurations for SYNPROXY references reachable from OUTPUT hooks.
  • After updating, reboot into the corrected kernel and confirm its running version.
  • In a safe test environment, confirm unsupported SYNPROXY OUTPUT rules are rejected.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-40206 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-40206Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxee394f96ad7517fbc0de9106dcc7ce9efb14f264, ee394f96ad7517fbc0de9106dcc7ce9efb14f264, ee394f96ad7517fbc0de9106dcc7ce9efb14f264, ee394f96ad7517fbc0de9106dcc7ce9efb14f264, ee394f96ad7517fbc0de9106dcc7ce9efb14f264unaffected
LinuxLinux5.4, 0, 6.1.184, 6.6.113, 6.12.54, 6.17.4, 6.18affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.