Login Sign Up

CVE-2025-38037

5.5 MEDIUM

📋 TL;DR

This CVE describes a data race condition in the Linux kernel's VXLAN implementation where concurrent access to FDB (Forwarding Database) entry fields ('used' and 'updated') can cause inconsistent state. This affects systems using VXLAN networking with multiple threads accessing the same FDB entries simultaneously. The vulnerability could lead to kernel instability or incorrect network behavior.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Specific affected versions not specified in CVE, but fix commits target stable branches.
Operating Systems: Linux distributions using affected kernel versions
Default Config Vulnerable: ✅ No
Notes: Only affects systems with VXLAN interfaces configured and multiple concurrent threads accessing FDB entries.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash due to race condition leading to memory corruption or inconsistent network state.

🟠

Likely Case

Intermittent network connectivity issues, packet loss, or incorrect forwarding decisions in VXLAN networks.

🟢

If Mitigated

Minor performance impact with proper synchronization, but no security or stability issues.

🌐 Internet-Facing: LOW - Requires local network access and specific VXLAN configuration.
🏢 Internal Only: MEDIUM - Affects internal VXLAN networks where multiple threads access FDB entries concurrently.

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: NO
Unauthenticated Exploit: ✅ No
Complexity: HIGH

The provided script demonstrates the race condition but doesn't show weaponization. Exploitation requires specific VXLAN configuration and concurrent access patterns.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 02a33b1035a3, 13cba3f83790, 4eceb7eae6ea, 784b78295a3a, 87d076987a9b

Vendor Advisory: https://git.kernel.org/stable/c/02a33b1035a307453a1da6ce0a1bf3676be287d7

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable KCSAN reporting

linux

Suppress Kernel Concurrency Sanitizer reports for vxlan_xmit function

echo !vxlan_xmit > /sys/kernel/debug/kcsan

Avoid concurrent VXLAN traffic

linux

Limit VXLAN interface usage to single threads or processes

🧯 If You Can't Patch

  • Disable VXLAN interfaces if not required
  • Implement network segmentation to isolate VXLAN traffic

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if VXLAN is configured. Run provided reproduction script to trigger KCSAN reports.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits. Run reproduction script and confirm no KCSAN reports for vxlan_xmit.

📡 Detection & Monitoring

Log Indicators:

  • Kernel logs showing KCSAN data-race reports for vxlan_xmit
  • System crashes or instability when using VXLAN

Network Indicators:

  • Inconsistent VXLAN packet forwarding
  • Increased packet loss on VXLAN interfaces

SIEM Query:

source="kernel" AND "KCSAN: data-race" AND "vxlan_xmit"

📊 Metadata

CVE ID: CVE-2025-38037
CVSS v3 Score: 5.5 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS Score: 0.03% exploit probability (8.7th percentile)
Published: June 18, 2025
Last Updated: December 18, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON