DSA Interface Vulnerability in Linux Package: Cleanup of FDB, MDB, VLAN Entries on Unbind
Summary
DEBIAN-CVE-2025-37864: In the Linux kernel, the following vulnerability has been resolved: net: dsa: clean up FDB, MDB, VLAN entries on unbind As explained in many places such as commit b117e1e8a86d ("net: dsa: delete dsa_legacy_fdb_add and ds... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, responsible for managing hardware and system resources. It provides essential services for all other software running on the system. The kernel's networking subsystem, particularly the Distributed Switch Architecture (DSA), is designed to manage network interfaces and their configurations. This vulnerability affects the DSA implementation, specifically in how it handles Forwarding Database (FDB), Multicast Database (MDB), and VLAN entries during the unbinding process.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the DSA subsystem where it fails to properly clean up FDB, MDB, and VLAN entries when a driver is unbound. This oversight can lead to lingering entries that may cause warnings and potential resource leaks. The issue arises from the assumption that higher layers manage the addition and deletion of entries correctly. When this assumption is violated, it can result in unexpected behavior and system instability, particularly for drivers that support bridge bypass operations.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users can monitor their network configurations closely and avoid unbinding drivers with active FDB or VLAN entries until the patch is applied.
Conclusion
The identified vulnerability in the Linux kernel's DSA subsystem poses significant risks related to network management. Users are strongly advised to update to the patched version to mitigate these risks. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to resource leaks and warnings in the kernel log, potentially affecting network performance and stability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
While there is no direct risk of data loss, the instability caused by lingering entries can lead to unexpected behavior in network operations.
If an immediate update is not possible, closely monitor your network configurations and avoid unbinding drivers with active entries.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-37864.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
