CVE-2025-21648

What it actually does

Improper validation allows conntrack hashtable size to exceed INT_MAX, triggering WARN_ON_ONCE in __kvmalloc_node_noprof during resize from init_netns because __GFP_NOWARN is unset.

Why it matters to the business

Low-likelihood operational warnings or instability in network connection tracking on affected Linux systems; listed PHP packages on Red Hat Enterprise Linux 6 require patching despite low EPSS and no KEV status.

How an attack unfolds

Local attacker manipulates conntrack settings in the initial network namespace to request an oversized hashtable, hitting the allocation warning path.

How to fix it

Upgrade all listed packages to the provided fixed versions including php 0:5.3.3-48.el6_8, php-bcmath 0:5.3.3-48.el6_8 and equivalent updates for php-cli, php-common, php-devel and remaining components.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases and verify absence of kvmalloc warnings during conntrack operations.

Typical attack path

1. Gain local user access on affected system
2. Trigger conntrack hashtable resize operation
3. Supply size value exceeding INT_MAX

How to detect it

Review kernel logs for WARN_ON_ONCE messages from __kvmalloc_node_noprof during conntrack hashtable resize attempts from init_netns.

• WARN_ON_ONCE in __kvmalloc_node_noprof
• conntrack hashtable resize exceeding INT_MAX

What your security team should do

• Apply the listed package updates to reach fixed versions
• Monitor kernel logs for allocation warnings
• Limit local privileged access to network namespace configuration