Data Race Vulnerability in Linux Kernel vxlan Package
Summary
CVE-2025-38037: In the Linux kernel, the following vulnerability has been resolved: vxlan: Annotate FDB data races The 'used' and 'updated' fields in the FDB entry structure can be accessed concurrently by multiple threads, leading to r... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The vxlan (Virtual Extensible LAN) feature allows for the encapsulation of Layer 2 Ethernet frames in Layer 4 UDP packets, enabling the creation of virtualized network overlays. This functionality is crucial for modern cloud and data center environments, where network segmentation and isolation are necessary. However, the vxlan implementation has been found to have a data race vulnerability, which can lead to inconsistent behavior and potential system instability.
Vulnerability Detail
The vulnerability, identified as CVE-2025-38037, arises from concurrent access to the 'used' and 'updated' fields in the Forwarding Database (FDB) entry structure within the vxlan implementation. This data race can lead to unexpected behavior, including crashes or data corruption, as multiple threads may read and write to these fields simultaneously. The issue was reported by the Kernel Concurrency Sanitizer, highlighting the risks associated with this concurrency flaw. The vulnerability can be exploited under specific conditions, particularly in high-load environments where multiple threads interact with the vxlan functionality.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can suppress the reports generated by the Kernel Concurrency Sanitizer by annotating the accesses to the 'used' and 'updated' fields using the following commands in a bash script:
#!/bin/bash set +H echo whitelist > /sys/kernel/debug/kcsan echo !vxlan_xmit > /sys/kernel/debug/kcsan
Additionally, users can reproduce the issue using the following commands: ip link add name vx0 up type vxlan id 10010 dstport 4789 local 192.0.2.1 bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 198.51.100.1 taskset -c 0 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q & taskset -c 2 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q &
Conclusion
The CVE-2025-38037 vulnerability in the Linux kernel's vxlan implementation poses significant risks due to data races in concurrent access. Users are advised to update their kernel packages to the patched version to mitigate these risks. For those unable to update immediately, a workaround is available to suppress error reports. Monitoring for updates is crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38037 is a data race vulnerability in the vxlan implementation of the Linux kernel, which can lead to inconsistent behavior and potential system crashes.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to sign up.
The risks include system instability, crashes, and data corruption due to concurrent access to shared resources in the vxlan implementation.
Yes, a patched version (6.12.32-1) is available for Debian 13. Users of Debian 11 and 12 should monitor for updates as the urgency for a fix has not yet been assigned.
As a temporary measure, you can suppress the reports generated by the Kernel Concurrency Sanitizer by following the provided workaround instructions.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
