Login Sign Up

CVE-2025-37789

7.8 HIGH
Denial of Service

📋 TL;DR

This vulnerability in the Linux kernel's Open vSwitch module allows attackers to trigger a kernel panic or potentially execute arbitrary code by sending malformed network packets. It affects systems running vulnerable Linux kernel versions with Open vSwitch enabled, particularly cloud infrastructure, virtualization platforms, and network appliances.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Specific affected kernel versions not specified in CVE description; check kernel commit references for exact versions.
Operating Systems: Linux distributions using affected kernel versions
Default Config Vulnerable: ✅ No
Notes: Only vulnerable if Open vSwitch kernel module is loaded and configured. Common in virtualization, cloud, and SDN environments.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to full system compromise, denial of service affecting entire host, or privilege escalation to kernel level.

🟠

Likely Case

Kernel panic causing system crash and denial of service, requiring host reboot to restore functionality.

🟢

If Mitigated

Limited impact if Open vSwitch is not enabled or if network access is restricted to trusted sources only.

🌐 Internet-Facing: MEDIUM - Requires Open vSwitch to be enabled and accessible via network, which is common in cloud/virtualization environments.
🏢 Internal Only: MEDIUM - Internal attackers or compromised internal systems could exploit this to crash hosts or escalate privileges.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: MEDIUM

Exploitation requires sending specially crafted network packets to Open vSwitch. No public exploit code available at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 03d7262dd53e8c404da35cc81aaa887fd901f76b, 1489c195c8eecd262aa6712761ba5288203e28ec, 54c6957d1123a2032099b9eab51c314800f677ce, 65d91192aa66f05710cfddf6a14b5a25ee554dba, 7fcaec0b2ab8fa5fbf0b45e5512364a168f445bd

Vendor Advisory: https://git.kernel.org/stable/c/03d7262dd53e8c404da35cc81aaa887fd901f76b

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify Open vSwitch module loads correctly after reboot.

🔧 Temporary Workarounds

Disable Open vSwitch kernel module

linux

Prevent loading of vulnerable Open vSwitch kernel module if not required.

echo 'blacklist openvswitch' >> /etc/modprobe.d/blacklist-ovs.conf
rmmod openvswitch

Restrict network access to Open vSwitch

linux

Limit which network interfaces and IP addresses can communicate with Open vSwitch.

iptables -A INPUT -p tcp --dport 6640 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 6640 -j DROP

🧯 If You Can't Patch

  • Disable Open vSwitch functionality if not essential for operations.
  • Implement strict network segmentation to isolate Open vSwitch traffic to trusted zones only.

🔍 How to Verify

Check if Vulnerable:

Check if Open vSwitch kernel module is loaded: lsmod | grep openvswitch. If loaded, check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits: uname -r and check with distribution vendor. Confirm Open vSwitch operates normally after patch.

📡 Detection & Monitoring

Log Indicators:

  • Kernel panic messages in /var/log/messages or dmesg
  • Open vSwitch crash logs
  • Unexpected system reboots

Network Indicators:

  • Malformed packets to Open vSwitch ports (typically 6640, 6653)
  • Unusual traffic patterns to virtualization management interfaces

SIEM Query:

source="kernel" AND ("panic" OR "Oops") AND "openvswitch"

📊 Metadata

CVE ID: CVE-2025-37789
CVSS v3 Score: 7.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score: 0.03% exploit probability (6.4th percentile)
Published: May 1, 2025
Last Updated: November 6, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON