ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-37921

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifi

Published May 20, 2025 · catalog updated Oct 15, 2026 · Linux Linux

Check if you run it

No confirmed exploitation is on record for CVE-2025-37921. EPSS is 0.24%. Act only if a listed version of Linux Linux is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.24%
Remediation
Version ranges on file
Affected products
cpe debian/debian linux · cpe linux/linux kernel · vendor Linux Linux f9c4bb0b245cee35ef66f75bf409c9573d934cf9 <2d4a121296aa3940d2df9906f955c2b6b4e38bc3

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotation that was added by commit ebe642067455 ("vxlan: Create wrappers for FDB lookup"). Reproducer: # ip link add vx0 up type vxlan dstport 4789 external vnifilter local 192.0.2.1 # bridge vni add vni 10010 remote 198.51.100.1 dev vx0 # bridge vni del vni 10010 dev vx0 Fix by acquiring the hash lock before the deletion and releasing it afterwards. Blame the original commit that introduced the issue rather than the one that exposed it. [1] WARNING: CPU: 3 PID: 392 at drivers/net/vxlan/vxlan_core.c:417 vxlan_find_mac+0x17f/0x1a0 [...] RIP: 0010:vxlan_find_mac+0x17f/0x1a0 [...] Call Trace: __vxlan_fdb_delete+0xbe/0x560 vxlan_vni_delete_group+0x2ba/0x940 vxlan_vni_del.isra.0+0x15f/0x580 vxlan_process_vni_filter+0x38b/0x7b0 vxlan_vnifilter_process+0x3bb/0x510 rtnetlink_rcv_msg+0x2f7/0xb70 netlink_rcv_skb+0x131/0x360 netlink_unicast+0x426/0x710 netlink_sendmsg+0x75a/0xc20 __sock_sendmsg+0xc1/0x150 ____sys_sendmsg+0x5aa/0x7b0 ___sys_sendmsg+0xfc/0x180 __sys_sendmsg+0x121/0x1b0 do_syscall_64+0xbb/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe debian/debian linux11.0
  • cpe linux/linux kernel6.15
  • vendor Linux Linux f9c4bb0b245cee35ef66f75bf409c9573d934cf9 <2d4a121296aa3940d2df9906f955c2b6b4e38bc3f9c4bb0b245cee35ef66f75bf409c9573d934cf9 <2d4a121296aa3940d2df9906f955c2b6b4e38bc3

How to fix CVE-2025-37921

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2025-37921. EPSS is 0.24%. Act only if a listed version of Linux Linux is installed.

Which versions are affected?

Compare what you have installed with debian/debian linux 11.0; linux/linux kernel 6.15; Linux Linux f9c4bb0b245cee35ef66f75bf409c9573d934cf9 <2d4a121296aa3940d2df9906f955c2b6b4e38bc3 f9c4bb0b245cee35ef66f75bf409c9573d934cf9 <2d4a121296aa3940d2df9906f955c2b6b4e38bc3. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.24%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 20, 2025 · NIST NVD

    Detected

    In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotatio

  2. Oct 15, 2026 · NIST NVD

    Updated

    In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotatio

Sources

  • CVE.orgVulnerability recordCVE-2025-37921

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-37921

    30-day exploitation probability 0.2%

    first.org
  • EUVDVulnerability recordEUVD-2025-15924

    In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is delete

    euvd.enisa.europa.eu
  • NIST NVDVulnerability recordCVE-2025-37921

    In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is dele

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.