Unsecured Deletion of Default FDB Entry in Linux Kernel's VXLAN Module
Summary
CVE-2025-37921: In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted from a VXLAN device in 'vnifilter' mode, the FDB entry associated wit... Affects linux versions < 6.1.140-1. Fixed in 6.1.140-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports various networking protocols, including VXLAN (Virtual Extensible LAN), which allows for the encapsulation of Layer 2 Ethernet frames in Layer 4 UDP packets. This functionality is crucial for creating virtualized network environments. However, a recent vulnerability has been identified in the VXLAN module, specifically in the vnifilter mode, which can lead to potential security risks if not addressed.
Vulnerability Detail
The vulnerability, identified as CVE-2025-37921, arises when a Virtual Network Identifier (VNI) is deleted from a VXLAN device in vnifilter mode. The associated Forwarding Database (FDB) entry for the default remote is deleted without acquiring the necessary hash lock, leading to a warning generated by the lockdep annotation. This oversight can result in undefined behavior and potential exploitation, as it exposes the system to race conditions and inconsistencies in network operations.
How To Fix
Minimum fixed version
6.1.140-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2025-37921 represents a significant vulnerability in the Linux kernel's VXLAN module that requires immediate attention. Users are advised to update their systems to the patched version to prevent potential exploitation. Monitoring tools like Vulert can assist in identifying vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37921 is a vulnerability in the Linux kernel's VXLAN module that allows for the unsecured deletion of default FDB entries, potentially leading to network inconsistencies.
If exploited, this vulnerability can lead to race conditions and undefined behavior in network operations, which may compromise the integrity of network communications.
You should update your Linux kernel to the latest patched version as soon as it is available to mitigate the risks associated with this vulnerability.
Yes, you can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities by analyzing your manifest file. You can also check your application against this vulnerability using the Vulert playground without any signup.
Detailed information about CVE-2025-37921 can be found in the official CVE database and through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
