CVE-2025-37959: bpf: Scrub packet on bpf_redirect_peer
bpf: Scrub packet on bpfredirectpeer
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch bpf: Scrub packet on bpf_redirect_peer - Compensating control
If you are using Cilium and observe traffic drops on IPsec→container redirects, apply a temporary networking workaround to avoid relying on bpf_redirect_peer/IPsec decryption paths that can trigger __xfrm_policy_check dropping in the container netns (e.g., route/redirect via a netns switch path where the skb is scrubbed, such as the typical veth netns switch behavior mentioned in the trace).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37959?
CVE-2025-37959 has been classified with a moderate severity due to the potential information leakage between network namespaces.
How do I fix CVE-2025-37959?
To fix CVE-2025-37959, update your Linux kernel to the latest patched version provided by your distribution.
What impact does CVE-2025-37959 have on network security?
CVE-2025-37959 can lead to unauthorized access to sensitive information by allowing packet data from one network namespace to leak into another.
Which versions of the Linux kernel are affected by CVE-2025-37959?
CVE-2025-37959 affects multiple versions of the Linux kernel that implement the bpf_redirect_peer functionality without proper skb scrubbing.
Is CVE-2025-37959 exploitable in production environments?
Yes, CVE-2025-37959 can be exploited in production environments, particularly those using network namespaces for containerization or similar technologies.