CVE-2025-37998

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37998", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.976Z", "datePublished": "2025-05-29T13:15:56.197Z", "dateUpdated": "2026-10-15T21:52:05.968Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:50.276Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: Fix unsafe attribute parsing in output_userspace()\n\nThis patch replaces the manual Netlink attribute iteration in\noutput_userspace() with nla_for_each_nested(), which ensures that only\nwell-formed attributes are processed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The malformed action must be installed through the openvswitch generic-netlink interface (OVS_PACKET_CMD_EXECUTE or OVS_FLOW_CMD_NEW), which requires a local netlink socket. A remote peer's packets cannot introduce malformed attributes, since the datapath's action list is written only by local userspace.\nAC:L - Exploitation is fully deterministic \u2014 the attacker crafts a nested attribute with nla_len of 0, 1-3, or 0xFFFF and executes it; there is no race and no dependence on memory layout to trigger the loop or the OOB copy. Liberal netlink validation accepts the malformed trailer unconditionally.\nPR:L - The OVS genl ops use GENL_UNS_ADMIN_PERM with .netnsok = true, i.e. netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN), so an ordinary unprivileged user obtains the needed capability via `unshare -Urn` and creates their own datapath. No real root in the init namespace is required.\nUI:N - The attacker installs the action and triggers execution entirely from their own process via netlink; no victim action or cooperating process is involved.\nS:U - The corruption and disclosure are confined to the kernel that the attacker is already interacting with \u2014 standard local kernel compromise with no crossing into a hypervisor, IOMMU, or other security authority.\nC:H - A USERDATA attribute with nla_len 0xFFFF makes queue_userspace_packet() copy ~64KB from beyond the \u226432KB sw_flow_actions allocation directly into the upcall netlink message sent to the attacker's own socket, yielding a repeatable arbitrary-offset kernel heap read that defeats KASLR and leaks adjacent object contents.\nI:H - A USERDATA attribute with nla_len of 1-3 makes nla_len() negative, and queue_userspace_packet() uses __nla_put() with no tailroom check, so memcpy() is invoked with a size_t of ~2^64 \u2014 an unbounded out-of-bounds write past the skb constituting severe heap memory corruption.\nA:H - An attribute with nla_len == 0 makes NLA_ALIGN(0) == 0, so nla_next() neither advances the pointer nor decrements rem, hanging the CPU in an infinite loop inside the packet-processing path with RCU read lock held; the wild memcpy and OOB read paths additionally produce immediate oops/panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/openvswitch/actions.c"], "versions": [{"version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "6712dc21506738f5f22b4f68b7c0d9e0df819dbd", "status": "affected", "versionType": "git"}, {"version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "06b4f110c79716c181a8c5da007c259807840232", "status": "affected", "versionType": "git"}, {"version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "47f7f00cf2fa3137d5c0416ef1a71bdf77901395", "status": "affected", "versionType": "git"}, {"version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "bca8df998cce1fead8cbc69144862eadc2e34c87", "status": "affected", "versionType": "git"}, {"version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "0236742bd959332181c1fcc41a05b7b709180501", "status": "affected", "versionType": "git"}, {"version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "ec334aaab74705cc515205e1da3cb369fdfd93cd", "status": "affected", "versionType": "git"}, {"version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "4fa672cbce9c86c3efb8621df1ae580d47813430", "status": "affected", "versionType": "git"}, {"version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "6beb6835c1fbb3f676aebb51a5fee6b77fed9308", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/openvswitch/actions.c"], "versions": [{"version": "3.3", "status": "affected"}, {"version": "0", "lessThan": "3.3", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.294", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.238", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.183", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.139", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.91", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.29", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.7", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.4.294"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.10.238"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.15.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.1.139"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.6.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.12.29"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.14.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.15"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6712dc21506738f5f22b4f68b7c0d9e0df819dbd"}, {"url": "https://git.kernel.org/stable/c/06b4f110c79716c181a8c5da007c259807840232"}, {"url": "https://git.kernel.org/stable/c/47f7f00cf2fa3137d5c0416ef1a71bdf77901395"}, {"url": "https://git.kernel.org/stable/c/bca8df998cce1fead8cbc69144862eadc2e34c87"}, {"url": "https://git.kernel.org/stable/c/0236742bd959332181c1fcc41a05b7b709180501"}, {"url": "https://git.kernel.org/stable/c/ec334aaab74705cc515205e1da3cb369fdfd93cd"}, {"url": "https://git.kernel.org/stable/c/4fa672cbce9c86c3efb8621df1ae580d47813430"}, {"url": "https://git.kernel.org/stable/c/6beb6835c1fbb3f676aebb51a5fee6b77fed9308"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-307/"}], "title": "openvswitch: Fix unsafe attribute parsing in output_userspace()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:58:12.202Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37998", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:46:40.143387Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:52:05.968Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:58:12.202Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-37998", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:46:40.143387Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:46:40.955Z"}}], "cna": {"title": "openvswitch: Fix unsafe attribute parsing in output_userspace()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The malformed action must be installed through the openvswitch generic-netlink interface (OVS_PACKET_CMD_EXECUTE or OVS_FLOW_CMD_NEW), which requires a local netlink socket. A remote peer's packets cannot introduce malformed attributes, since the datapath's action list is written only by local userspace.\nAC:L - Exploitation is fully deterministic \u2014 the attacker crafts a nested attribute with nla_len of 0, 1-3, or 0xFFFF and executes it; there is no race and no dependence on memory layout to trigger the loop or the OOB copy. Liberal netlink validation accepts the malformed trailer unconditionally.\nPR:L - The OVS genl ops use GENL_UNS_ADMIN_PERM with .netnsok = true, i.e. netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN), so an ordinary unprivileged user obtains the needed capability via `unshare -Urn` and creates their own datapath. No real root in the init namespace is required.\nUI:N - The attacker installs the action and triggers execution entirely from their own process via netlink; no victim action or cooperating process is involved.\nS:U - The corruption and disclosure are confined to the kernel that the attacker is already interacting with \u2014 standard local kernel compromise with no crossing into a hypervisor, IOMMU, or other security authority.\nC:H - A USERDATA attribute with nla_len 0xFFFF makes queue_userspace_packet() copy ~64KB from beyond the \u226432KB sw_flow_actions allocation directly into the upcall netlink message sent to the attacker's own socket, yielding a repeatable arbitrary-offset kernel heap read that defeats KASLR and leaks adjacent object contents.\nI:H - A USERDATA attribute with nla_len of 1-3 makes nla_len() negative, and queue_userspace_packet() uses __nla_put() with no tailroom check, so memcpy() is invoked with a size_t of ~2^64 \u2014 an unbounded out-of-bounds write past the skb constituting severe heap memory corruption.\nA:H - An attribute with nla_len == 0 makes NLA_ALIGN(0) == 0, so nla_next() neither advances the pointer nor decrements rem, hanging the CPU in an infinite loop inside the packet-processing path with RCU read lock held; the wild memcpy and OOB read paths additionally produce immediate oops/panic."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "6712dc21506738f5f22b4f68b7c0d9e0df819dbd", "versionType": "git"}, {"status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "06b4f110c79716c181a8c5da007c259807840232", "versionType": "git"}, {"status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "47f7f00cf2fa3137d5c0416ef1a71bdf77901395", "versionType": "git"}, {"status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "bca8df998cce1fead8cbc69144862eadc2e34c87", "versionType": "git"}, {"status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "0236742bd959332181c1fcc41a05b7b709180501", "versionType": "git"}, {"status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "ec334aaab74705cc515205e1da3cb369fdfd93cd", "versionType": "git"}, {"status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "4fa672cbce9c86c3efb8621df1ae580d47813430", "versionType": "git"}, {"status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "lessThan": "6beb6835c1fbb3f676aebb51a5fee6b77fed9308", "versionType": "git"}], "programFiles": ["net/openvswitch/actions.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.3"}, {"status": "unaffected", "version": "0", "lessThan": "3.3", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.294", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.238", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.183", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.139", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.91", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.29", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.14.7", "versionType": "semver", "lessThanOrEqual": "6.14.*"}, {"status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/openvswitch/actions.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/6712dc21506738f5f22b4f68b7c0d9e0df819dbd"}, {"url": "https://git.kernel.org/stable/c/06b4f110c79716c181a8c5da007c259807840232"}, {"url": "https://git.kernel.org/stable/c/47f7f00cf2fa3137d5c0416ef1a71bdf77901395"}, {"url": "https://git.kernel.org/stable/c/bca8df998cce1fead8cbc69144862eadc2e34c87"}, {"url": "https://git.kernel.org/stable/c/0236742bd959332181c1fcc41a05b7b709180501"}, {"url": "https://git.kernel.org/stable/c/ec334aaab74705cc515205e1da3cb369fdfd93cd"}, {"url": "https://git.kernel.org/stable/c/4fa672cbce9c86c3efb8621df1ae580d47813430"}, {"url": "https://git.kernel.org/stable/c/6beb6835c1fbb3f676aebb51a5fee6b77fed9308"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-307/"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: Fix unsafe attribute parsing in output_userspace()\n\nThis patch replaces the manual Netlink attribute iteration in\noutput_userspace() with nla_for_each_nested(), which ensures that only\nwell-formed attributes are processed."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.4.294", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.238", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.183", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.139", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.91", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.29", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14.7", "versionStartIncluding": "3.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.15", "versionStartIncluding": "3.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:50.276Z"}}}, "cveMetadata": {"cveId": "CVE-2025-37998", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:52:05.968Z", "dateReserved": "2025-04-16T04:51:23.976Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-05-29T13:15:56.197Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/openvswitch/actions.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "6712dc21506738f5f22b4f68b7c0d9e0df819dbd", "status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "versionType": "git"}, {"lessThan": "06b4f110c79716c181a8c5da007c259807840232", "status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "versionType": "git"}, {"lessThan": "47f7f00cf2fa3137d5c0416ef1a71bdf77901395", "status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "versionType": "git"}, {"lessThan": "bca8df998cce1fead8cbc69144862eadc2e34c87", "status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "versionType": "git"}, {"lessThan": "0236742bd959332181c1fcc41a05b7b709180501", "status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "versionType": "git"}, {"lessThan": "ec334aaab74705cc515205e1da3cb369fdfd93cd", "status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "versionType": "git"}, {"lessThan": "4fa672cbce9c86c3efb8621df1ae580d47813430", "status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "versionType": "git"}, {"lessThan": "6beb6835c1fbb3f676aebb51a5fee6b77fed9308", "status": "affected", "version": "ccb1352e76cff0524e7ccb2074826a092dd13016", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/openvswitch/actions.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.3"}, {"lessThan": "3.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.294", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.238", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.183", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.139", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.91", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.29", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "318EFE16-B5BC-4E2F-997C-C28C8E9CF591", "versionEndExcluding": "5.4.294", "versionStartIncluding": "3.3", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DAAEF7F-D560-47FC-8B65-20404DB82432", "versionEndExcluding": "5.10.238", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "94D91ED4-346E-41EE-ACF5-F184C0A863D5", "versionEndExcluding": "5.15.183", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "70A2F216-574B-4B80-86BC-988928D5B83D", "versionEndExcluding": "6.1.139", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6826C73-C5C9-430D-84C9-4045DFD72074", "versionEndExcluding": "6.6.91", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7215ABCF-8EB1-46CD-8872-8BCE4890E579", "versionEndExcluding": "6.12.29", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5715A6F5-A34A-4B27-8A64-82825E963995", "versionEndExcluding": "6.14.7", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*", "matchCriteriaId": "8D465631-2980-487A-8E65-40AE2B9F8ED1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*", "matchCriteriaId": "4C9D071F-B28E-46EC-AC61-22B913390211", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*", "matchCriteriaId": "13FC0DDE-E513-465E-9E81-515702D49B74", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*", "matchCriteriaId": "8C7B5B0E-4EEB-48F5-B4CF-0935A7633845", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*", "matchCriteriaId": "2D240580-3048-49B2-9E27-F115A9DF8224", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nopenvswitch: Fix unsafe attribute parsing in output_userspace()\n\nThis patch replaces the manual Netlink attribute iteration in\noutput_userspace() with nla_for_each_nested(), which ensures that only\nwell-formed attributes are processed."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: openvswitch: corrige el an\u00e1lisis de atributos inseguro en output_userspace() Este parche reemplaza la iteraci\u00f3n manual de atributos Netlink en output_userspace() con nla_for_each_nested(), que garantiza que solo se procesen los atributos bien formados."}], "id": "CVE-2025-37998", "lastModified": "2026-10-15T22:18:23.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-37998", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:46:40.143387Z", "version": "2.0.3"}}]}, "published": "2025-05-29T14:15:36.450", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0236742bd959332181c1fcc41a05b7b709180501"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/06b4f110c79716c181a8c5da007c259807840232"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/47f7f00cf2fa3137d5c0416ef1a71bdf77901395"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4fa672cbce9c86c3efb8621df1ae580d47813430"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6712dc21506738f5f22b4f68b7c0d9e0df819dbd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6beb6835c1fbb3f676aebb51a5fee6b77fed9308"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bca8df998cce1fead8cbc69144862eadc2e34c87"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ec334aaab74705cc515205e1da3cb369fdfd93cd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Third Party Advisory"], "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-307/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: openvswitch: Fix unsafe attribute parsing in output_userspace()", "id": "2369185", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2369185"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-241", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nopenvswitch: Fix unsafe attribute parsing in output_userspace()\nThis patch replaces the manual Netlink attribute iteration in\noutput_userspace() with nla_for_each_nested(), which ensures that only\nwell-formed attributes are processed."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, prevent module openvswitch from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically."}, "name": "CVE-2025-37998", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-29T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37998\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37998\nhttps://lore.kernel.org/linux-cve-announce/2025052903-CVE-2025-37998-10fb@gregkh/T"], "statement": "The bug could happen only if Open vSwitch is being used (that is a multilayer Ethernet switch targeted at virtualized environments). The bug doesn't lead to kernel crash, but more about possibility of incorrect behavior (can lead to some corrupted data being processed). The security impact is limited.", "threat_severity": "Moderate"}

{"created": "2025-06-24T09:44:22.567274+00:00", "updated": "2025-06-24T09:44:22.567322+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}