Answer in brief
CVE-2025-40206 records a High severity (CVSS 7.8) vulnerability in netfilter: nft_objref: validate objref and objrefmap expressions. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ee394f96ad7517fbc0de9106dcc7ce9efb14f264 <0028e0134c64d9ed21728341a74fcfc59cd0f944 || >=ee394f96ad7517fbc0de9106dcc7ce9efb14f264 <7ea55a44493a5a36c3b3293b88bbe4841f9dbaf0 || >=ee394f96ad7517fbc0de9106dcc7ce9efb14f264 <4c1cf72ec10be5a9ad264650cadffa1fbce6fabd || >=ee394f96ad7517fbc0de9106dcc7ce9efb14f264 <f359b809d54c6e3dd1d039b97e0b68390b0e53e4 | 0028e0134c64d9ed21728341a74fcfc59cd0f944, 7ea55a44493a5a36c3b3293b88bbe4841f9dbaf0, 4c1cf72ec10be5a9ad264650cadffa1fbce6fabd, f359b809d54c6e3dd1d039b97e0b68390b0e53e4 |
| Linux/Linuxgeneric | 5.4 | Not reported |
| Linux/Linuxgeneric | >=ee394f96ad7517fbc0de9106dcc7ce9efb14f264 <f31bcea12222a26d6f151df9c4a6d21f2eec1724 || >=ee394f96ad7517fbc0de9106dcc7ce9efb14f264 <0028e0134c64d9ed21728341a74fcfc59cd0f944 || >=ee394f96ad7517fbc0de9106dcc7ce9efb14f264 <7ea55a44493a5a36c3b3293b88bbe4841f9dbaf0 || >=ee394f96ad7517fbc0de9106dcc7ce9efb14f264 <4c1cf72ec10be5a9ad264650cadffa1fbce6fabd || >=ee394f96ad7517fbc0de9106dcc7ce9efb14f264 <f359b809d54c6e3dd1d039b97e0b68390b0e53e4 | f31bcea12222a26d6f151df9c4a6d21f2eec1724, 0028e0134c64d9ed21728341a74fcfc59cd0f944, 7ea55a44493a5a36c3b3293b88bbe4841f9dbaf0, 4c1cf72ec10be5a9ad264650cadffa1fbce6fabd, f359b809d54c6e3dd1d039b97e0b68390b0e53e4 |
Published upstream
Nov 12, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful object from OUTPUT hook causes kernel crash due to infinite recursive calls: BUG: TASK stack guard page was hit at 000000008bda5b8c (stack is 000000003ab1c4a5..00000000494d8b12) [...] Call Trace: __find_rr_leaf+0x99/0x230 fib6_table_lookup+0x13b/0x2d0 ip6_pol_route+0xa4/0x400 fib6_rule_lookup+0x156/0x240 ip6_route_output_flags+0xc6/0x150 __nf_ip6_route+0x23/0x50 synproxy_send_tcp_ipv6+0x106/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 nft_synproxy_do_eval+0x263/0x310 nft_do_chain+0x5a8/0x5f0 [nf_tables nft_do_chain_inet+0x98/0x110 nf_hook_slow+0x43/0xc0 __ip6_local_out+0xf0/0x170 ip6_local_out+0x17/0x70 synproxy_send_tcp_ipv6+0x1a2/0x200 synproxy_send_client_synack_ipv6+0x1aa/0x1f0 [...] Implement objref and objrefmap expression validate functions. Currently, only NFT_OBJECT_SYNPROXY object type requires validation. This will also handle a jump to a chain using a synproxy object from the OUTPUT hook. Now when trying to reference a synproxy object in the OUTPUT hook, nft will produce the following error: synproxy_crash.nft: Error: Could not process rule: Operation not supported synproxy name mysynproxy ^^^^^^^^^^^^^^^^^^^^^^^^
Quoted source text, attributed separately from HOL analysis.