Linux Kernel Vulnerability in DSA: mv88e6xxx VLAN Deletion Issue
Summary
CVE-2025-37865: In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: fix -ENOENT when deleting VLANs and MST is unsupported Russell King reports that on the ZII dev rev B, deleting a bridge VLAN from... Affects linux versions < 6.1.135-1. Fixed in 6.1.135-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The mv88e6xxx driver is responsible for managing Ethernet switches, specifically handling VLAN (Virtual Local Area Network) configurations. This vulnerability affects the deletion of bridge VLANs when MST (Multiple Spanning Tree) is unsupported, potentially leading to erroneous behavior in network configurations.
Vulnerability Detail
In the Linux kernel, a vulnerability exists in the mv88e6xxx driver where deleting a bridge VLAN from a user port can fail with an -ENOENT error. This occurs because the function mv88e6xxx_mst_put() attempts to find an MST entry associated with a VLAN ID (SID) that may not be properly initialized, leading to the use of garbage memory. The issue arises from certain implementations of the vtu_getnext() function not populating the vlan.sid field, which can cause unexpected behavior when VLANs are deleted.
How To Fix
Minimum fixed version
6.1.135-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
The CVE-2025-37865 vulnerability in the Linux kernel's mv88e6xxx driver poses a risk during VLAN deletion operations. It is crucial to apply the available patches to ensure network stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37865 is a vulnerability in the Linux kernel's mv88e6xxx driver that affects VLAN deletion when MST is unsupported.
If your system uses the mv88e6xxx driver and attempts to delete a bridge VLAN, it may encounter errors, potentially leading to network misconfigurations.
Yes, patches are available for Debian 12 and 13. Ensure your system is updated to the specified versions to mitigate the vulnerability.
While there are no specific workarounds, it is advisable to monitor your network configurations closely until the patch can be applied.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
