CVE-2025-37998

Q: What is the severity of CVE-2025-37998?

CVE-2025-37998 has a CVSS score of 5.5 (MEDIUM). This vulnerability in the Linux kernel's Open vSwitch module involves unsafe Netlink attribute parsing in the output_userspace() function. Attackers could potentially exploit this to cause kernel crashes or execute arbitrary code in kernel context. Systems running affected Linux kernel versions with Open vSwitch enabled are vulnerable.

5.5 MEDIUM

Denial of Service

📋 TL;DR

This vulnerability in the Linux kernel's Open vSwitch module involves unsafe Netlink attribute parsing in the output_userspace() function. Attackers could potentially exploit this to cause kernel crashes or execute arbitrary code in kernel context. Systems running affected Linux kernel versions with Open vSwitch enabled are vulnerable.

💻 Affected Systems

Products:

Linux kernel with Open vSwitch module

Versions: Specific kernel versions containing the vulnerable code (check git commits for exact ranges)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable if Open vSwitch kernel module is loaded and configured. Many systems don't use Open vSwitch by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash or potential kernel memory corruption enabling arbitrary code execution with kernel privileges.

🟠

Likely Case

Kernel crash causing denial of service, potentially requiring system reboot to restore functionality.

🟢

If Mitigated

No impact if Open vSwitch is not enabled or if proper kernel hardening measures are in place.

🌐 Internet-Facing: LOW - This requires local access or network access to Open vSwitch control plane, which is typically not internet-facing.

🏢 Internal Only: MEDIUM - Internal attackers with access to Open vSwitch management interfaces could potentially exploit this vulnerability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires sending malformed Netlink messages to the Open vSwitch kernel module, which typically requires some level of access to the system.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits 0236742bd959332181c1fcc41a05b7b709180501, 06b4f110c79716c181a8c5da007c259807840232, 47f7f00cf2fa3137d5c0416ef1a71bdf77901395, 4fa672cbce9c86c3efb8621df1ae580d47813430, or 6712dc21506738f5f22b4f68b7c0d9e0df819dbd

Vendor Advisory: https://git.kernel.org/stable/c/0236742bd959332181c1fcc41a05b7b709180501

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution vendor. 2. Reboot system to load new kernel. 3. Verify Open vSwitch module loads correctly after reboot.

🔧 Temporary Workarounds

Disable Open vSwitch kernel module

linux

Prevent loading of vulnerable Open vSwitch kernel module

echo 'blacklist openvswitch' >> /etc/modprobe.d/blacklist.conf
rmmod openvswitch

Restrict Netlink access

linux

Limit which users/processes can communicate with Open vSwitch via Netlink

# Use Linux security modules like SELinux or AppArmor to restrict access
# Configure appropriate MAC policies for ovs-vswitchd and related processes

🧯 If You Can't Patch

Disable Open vSwitch functionality if not required
Implement strict network segmentation to limit access to Open vSwitch management interfaces

🔍 How to Verify

Check if Vulnerable:

Check if Open vSwitch kernel module is loaded: lsmod | grep openvswitch

Check Version:

uname -r

Verify Fix Applied:

Check kernel version after update: uname -r and verify it includes the fix commits

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/messages or dmesg
Open vSwitch process crashes
Netlink error messages related to attribute parsing

Network Indicators:

Unusual Netlink traffic to Open vSwitch control plane
Multiple connection attempts to ovs-vswitchd management interface

SIEM Query:

source="kernel" AND ("panic" OR "Oops") AND "openvswitch" OR source="ovs-vswitchd" AND ("error" OR "crash")

📊 Metadata

CVE ID: CVE-2025-37998

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.04% exploit probability (11.3th percentile)

Published: May 29, 2025

Last Updated: December 16, 2025

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable Open vSwitch kernel module

Restrict Netlink access

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export