{"id":"CVE-2025-38678","title":"netfilter: nf_tables: reject duplicate device on updates","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: reject duplicate device on updates\n\nA chain/flowtable update with duplicated devices in the same batch is\npossible. Unfortunately, netdev event pa…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < 0521e694d5b80899fba8695881a6349f9bc538cb","Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < 4681960bc0f4f8bcc782cbf2fd205f48ad314dfd","Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < 4ce2a0c3b8497a66cfc25fc7ca3d087258a785d2","Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < 3f358a66a04513311668ea4b40f5064e253d8386","Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < cf23d531a9d496863aa4c5a0e2f71f0a23f3df3c","Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < d7615bde541f16517d6790412da6ec46fa8a4c1f","Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973","Linux 5.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:52:45.646428Z"},"exploitAvailable":true,"published":"2025-09-03","updated":"2026-10-15","sourceUpdated":"2026-10-15T22:02:27.949Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38678","references":[{"url":"https://git.kernel.org/stable/c/0521e694d5b80899fba8695881a6349f9bc538cb"},{"url":"https://git.kernel.org/stable/c/4681960bc0f4f8bcc782cbf2fd205f48ad314dfd"},{"url":"https://git.kernel.org/stable/c/4ce2a0c3b8497a66cfc25fc7ca3d087258a785d2"},{"url":"https://git.kernel.org/stable/c/3f358a66a04513311668ea4b40f5064e253d8386"},{"url":"https://git.kernel.org/stable/c/cf23d531a9d496863aa4c5a0e2f71f0a23f3df3c"},{"url":"https://git.kernel.org/stable/c/d7615bde541f16517d6790412da6ec46fa8a4c1f"},{"url":"https://git.kernel.org/stable/c/cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973"}],"tags":["cve.org","exploit-available"],"epss":0.0028,"epssPercentile":0.20415,"exploits":{"github":1,"githubRepos":["https://github.com/guard-wait/CVE-2025-38678_POC"],"checkedAt":"2026-10-27T16:46:23.449Z"},"ingestedAt":"2026-10-15T22:48:25.519Z","slug":"CVE-2025-38678","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: reject duplicate device on updates\n\nA chain/flowtable update with duplicated devices in the same batch is\npossible. Unfortunately, netdev event path only removes the first\ndevice that is found, leaving unregistered the hook of the duplicated\ndevice.\n\nCheck if a duplicated device exists in the transaction batch, bail out\nwith EEXIST in such case.\n\nWARNING is hit when unregistering the hook:\n\n [49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150\n [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S                  6.16.0+ #170 PREEMPT(full)\n [...]\n [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150\n\n## Affected\n\n- `Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < 0521e694d5b80899fba8695881a6349f9bc538cb`\n- `Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < 4681960bc0f4f8bcc782cbf2fd205f48ad314dfd`\n- `Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < 4ce2a0c3b8497a66cfc25fc7ca3d087258a785d2`\n- `Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < 3f358a66a04513311668ea4b40f5064e253d8386`\n- `Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < cf23d531a9d496863aa4c5a0e2f71f0a23f3df3c`\n- `Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < d7615bde541f16517d6790412da6ec46fa8a4c1f`\n- `Linux >= 78d9f48f7f44431a25da2b46b3a8812f6ff2b981 < cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973`\n- `Linux 5.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}