CVE-2025-39764

What it actually does

Double refcount increment on netfilter expectation objects during ctnetlink dump resumption when the last object matches the current one, causing a memory leak.

Why it matters to the business

Gradual memory exhaustion on Linux systems running affected kernels can lead to degraded performance or crashes, increasing operational risk for containerized and network-heavy workloads.

How an attack unfolds

A local attacker with low privileges repeatedly triggers ctnetlink expectation dump operations; the flawed refcount logic leaks memory on each cycle until the system becomes unstable.

How to fix it

Update the Linux kernel to the commit a4d634ded4d3d400f115d84f654f316f249531c9 or later stable releases containing the fix; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit a4d634ded4d3d400f115d84f654f316f249531c9 via git log or uname output against the fixed tag; monitor for absence of repeated refcount_inc_not_zero calls on the same expectation object.

Typical attack path

1. Obtain local unprivileged access to a Linux host
2. Invoke ctnetlink netlink sockets to trigger expectation dumping
3. Force repeated dump resumption using the last-object cookie path
4. Accumulate leaked objects until memory pressure causes denial of service

How to detect it

Monitor kernel memory statistics and slab allocator usage for netfilter expectation objects; correlate with netlink socket activity in audit logs.

What your security team should do

• Apply the referenced kernel commit immediately on all production systems
• Prioritize patching hosts with high container density or heavy netfilter usage
• Add kernel version checks to vulnerability scanning pipelines