CVE-2025-37921: vxlan: vnifilter: Fix unlocked deletion of default FDB entry
In the Linux kernel, the following vulnerability has been resolved:
vxlan: vnifilter: Fix unlocked deletion of default FDB entry
When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated with the default remote (assuming one was configured) is deleted without holding the hash lock. This is wrong and will result in a warning [1] being generated by the lockdep annotation that was added by commit ebe642067455 ("vxlan: Create wrappers for FDB lookup").
Reproducer:
# ip link add vx0 up type vxlan dstport 4789 external vnifilter local 192.0.2.1 # bridge vni add vni 10010 remote 198.51.100.1 dev vx0 # bridge vni del vni 10010 dev vx0
Fix by acquiring the hash lock before the deletion and releasing it afterwards. Blame the original commit that introduced the issue rather than the one that exposed it.
[1] WARNING: CPU: 3 PID: 392 at drivers/net/vxlan/vxlancore.c:417 vxlanfindmac+0x17f/0x1a0 [...] RIP: 0010:vxlanfindmac+0x17f/0x1a0 [...] Call Trace: <TASK> vxlanfdbdelete+0xbe/0x560 vxlanvnideletegroup+0x2ba/0x940 vxlanvnidel.isra.0+0x15f/0x580 vxlanprocessvnifilter+0x38b/0x7b0 vxlanvnifilterprocess+0x3bb/0x510 rtnetlinkrcvmsg+0x2f7/0xb70 netlinkrcvskb+0x131/0x360 netlinkunicast+0x426/0x710 netlinksendmsg+0x75a/0xc20 socksendmsg+0xc1/0x150 syssendmsg+0x5aa/0x7b0 syssendmsg+0xfc/0x180 syssendmsg+0x121/0x1b0 dosyscall64+0xbb/0x1d0 entrySYSCALL64afterhwframe+0x4b/0x53
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
In the VXLAN vnifilter VNI-deletion path, acquire the hash lock before deleting the default FDB entry and release the lock afterwards.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37921?
CVE-2025-37921 has been assigned a high severity level due to potential risks associated with FDB entry deletion in VXLAN devices.
How do I fix CVE-2025-37921?
To fix CVE-2025-37921, update the Linux kernel to the latest version that contains the patch for the vulnerability.
What is the impact of CVE-2025-37921 on Linux kernel systems?
The impact of CVE-2025-37921 is that it can lead to improper deletion of forwarding database entries, which may disrupt network operations.
Is CVE-2025-37921 specific to any particular Linux kernel version?
CVE-2025-37921 affects the Linux kernel but does not specify particular versions, so all users are advised to apply updates as necessary.
What conditions lead to the vulnerability described in CVE-2025-37921?
The vulnerability in CVE-2025-37921 occurs when a VNI is deleted from a VXLAN device operated in 'vnifilter' mode, potentially leading to unlocked deletion issues.