CVE-2025-38732

What it actually does

The flaw is a reference count leak on skb dst_entry for loopback packets in nf_reject_ipv4.c and related netfilter paths; packets arriving at PRE_ROUTING already carry a dst so the code incorrectly calls skb_dst_set without first checking, triggering the WARN and leaving the refcount unbalanced.

Why it matters to the business

Linux systems using netfilter reject rules may experience kernel warnings, memory accounting drift, or crashes under loopback traffic, leading to network filtering outages and unplanned reboots on servers and containers.

How an attack unfolds

An attacker generates traffic that matches an nftables or iptables reject rule while the packet traverses a loopback interface; the nf_reject code path then mishandles the pre-attached dst, causing the refcount leak and potential denial-of-service via kernel panic or resource exhaustion.

How to fix it

Update the Linux kernel to commit 7b8b503c06274ef3c6c1a107743f1ec0d0a53ef8 or later; for gostatsd packages upgrade to 28.3.0-r18 on Chainguard and Wolfi distributions.

How to confirm the fix worked

Verify the running kernel contains commit 7b8b503c06274ef3c6c1a107743f1ec0d0a53ef8; confirm absence of the skb_dst_check_unset WARN when loopback packets traverse reject rules.

Typical attack path

1. Send crafted packets that hit a reject verdict in nftables/iptables
2. Ensure the packet arrives via loopback or another interface that already attaches a dst_entry at PRE_ROUTING
3. Trigger nf_send_unreach or nft_reject_inet_eval which calls nf_reject_fill_skb_dst
4. Observe the skb_dst_set WARN and resulting refcount imbalance

How to detect it

Search kernel logs for the exact WARN string from skb_dst_check_unset and nf_reject_fill_skb_dst; inspect netfilter reject rule usage on loopback interfaces; review system crash dumps for unbalanced dst refcounts.

What your security team should do

• Apply the kernel patch or distribution update immediately on all affected hosts
• Audit nftables/iptables configurations that use reject rules on loopback traffic
• Monitor for the skb_dst_set WARN in kernel logs as an early indicator of exposure