CVE-2025-38201

What it actually does

The flaw allows an attacker to supply an oversized map bucket size to nft_set_pipapo, triggering an unset __GFP_NOWARN flag that causes WARN_ON_ONCE in __kvmalloc_node during hashtable resize.

Why it matters to the business

Local users or container workloads on affected Linux kernels can trigger kernel warnings and potential denial of service or escalation paths, increasing operational risk for systems running nats or custom kernel builds until patched.

How an attack unfolds

An attacker with local access crafts an nftables set operation that requests a map bucket exceeding INT_MAX, forcing the kernel into the vulnerable kvmalloc path and surfacing the warning that can be leveraged in container escape or privilege-escalation chains observed in similar Linux kernel issues on Container-Optimized OS.

How to fix it

Upgrade to a fixed kernel commit 1fe27f97944017a9d3c5af4d6d95282bff0f1147 or later; for nats packages use version 0.2.3-r2 or newer on Chainguard and Wolfi distributions.

How to confirm the fix worked

Verify the running kernel contains commit 1fe27f97944017a9d3c5af4d6d95282bff0f1147; confirm nft_set_pipapo bucket-size clamping logic is present in source or that package version matches the listed fixed releases.

Typical attack path

1. Obtain local shell or container access on an unpatched kernel
2. Load or interact with nftables to create a pipapo set with an oversized bucket parameter
3. Trigger map resize that hits the unclamped kvmalloc call
4. Observe or chain the resulting WARN_ON_ONCE into further kernel exploitation

How to detect it

Review kernel logs for WARN_ON_ONCE messages originating from __kvmalloc_node_noprof during nftables set operations; inspect nftables configuration history and any container workloads that create large pipapo sets.

What your security team should do

• Prioritize patching Linux kernels and nats deployments within the next maintenance window due to local escalation potential
• Restrict untrusted local access and nftables usage in containers until updates are applied
• Monitor EPSS trend and similar kernel CVEs for rising exploit maturity