https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:09:55 +0000 https://vulnerability.circl.lu/vuln/cve-2025-39764 <p><strong>Affected:</strong> Linux, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: ctnetlink: remove refcounting in expectation dumpers</p> <p>Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use that as the skip hint for dump resumption.</p> <p>AFAICS this has the same issue as the one resolved in the conntrack dumper, when we do if (!refcount_inc_not_zero(&amp;exp-&gt;use))</p> <p>to increment the refcount, there is a chance that exp == last, which causes a double-increment of the refcount and subsequent memory leak.</p> <p><strong>Affected:</strong> Linux, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: ctnetlink: remove refcounting in expectation dumpers</p> <p>Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use that as the skip hint for dump resumption.</p> <p>AFAICS this has the same issue as the one resolved in the conntrack dumper, when we do if (!refcount_inc_not_zero(&amp;exp-&gt;use))</p> <p>to increment the refcount, there is a chance that exp == last, which causes a double-increment of the refcount and subsequent memory leak.</p> https://vulnerability.circl.lu/vuln/cve-2025-39764