Critical· 9.8official fix available

CVE-2025-38472

A critical bug in the Linux kernel’s network connection‑tracking subsystem can cause a crash when a connection entry is removed. The flaw arises from uninitialized data being used during cleanup, leading to a kernel panic. It affects Linux kernel 6.16 and earlier, including Debian 11.

publishedJul 28, 2025

last modifiedJul 30, 2026

sourcesNVD

severity · cvss

9.8

critical · how bad it is

exploitation · epss

<1%

34th percentile · chance of exploitation in 30 days

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →

auto-deletes from the system

counting…on Aug 29, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

Who is affected

Linux kernel 6.16 and earlier, including Debian 11.0

Real-world impact

An attacker could crash the kernel, causing a denial of service on the affected system.

Why this severity

The CVSS score of 9.8 reflects that the flaw can be triggered remotely without authentication, and it can lead to a kernel crash that compromises confidentiality, integrity, and availability.

What to do about it

official fix available

recommended steps

01Upgrade your Linux kernel to version 6.16 or later, which includes the fix for the nf_conntrack crash.

NVD-referenced vendor advisory

Timeline

Jul 28, 2025 · Jul 28, 2025
Published
Disclosed and added to the National Vulnerability Database.
Jul 30, 2026 · 7d ago
Advisory updated
The NVD record was last revised.
Jul 30, 2026 · 6d ago
Official fix available
A vendor patch or mitigation now exists — see the remediation steps above.

How it’s attacked

Attack vectorNetwork (remote)

Attack complexityLow

Privileges requiredNone

User interactionNone needed

ScopeUnchanged

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

References & advisories

git.kernel.org/stable/c/2d72afb340657f03f7…patch
git.kernel.org/stable/c/76179961c423cd6980…patch
git.kernel.org/stable/c/938ce0e8422d3793fe…patch
git.kernel.org/stable/c/a47ef874189d47f934…patch
git.kernel.org/stable/c/fc38c249c622ff5e30…patch
lists.debian.org/debian-lts-announce/2025/10…third party advisory

NVD advisory ↗Search advisories ↗

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →