CVE-2025-38037
NoneCVSS
—
EPSS
0.2%
Published
Jun 18, 2025
CISA due date
—
Cloudanix analysis
A timing problem inside the Linux kernel's VXLAN networking code can cause internal warnings when many packets are sent at once, and updating the kernel removes those warnings.
- Exploitation
- Local Privilege
- Attacker needs
- Local User
- Complexity
- Theoretical
- Impact
- Other
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Patch
- Effort
- Low
- Patch risk
- None
What it actually does
Concurrent unsynchronized reads and writes to the 'used' and 'updated' fields inside VXLAN FDB entries from multiple vxlan_xmit paths, reported as data races by KCSAN.
Why it matters to the business
Kernel concurrency warnings and potential minor instability when VXLAN interfaces handle concurrent traffic; remediation urgency is low given age and lack of active exploitation.
How an attack unfolds
An attacker with local or network access that triggers simultaneous packet transmission on a VXLAN device can cause the unsynchronized field accesses; the race itself produces sanitizer reports rather than memory corruption or privilege escalation.
How to fix it
Upgrade to a kernel containing commit 02a33b1035a307453a1da6ce0a1bf3676be287d7 or later; rebuild and reboot affected systems; for Mageia 5 update chromium-browser-stable to 47.0.2526.73-1.mga5 or newer if the package ships a kernel component.
How to confirm the fix worked
Boot with KCSAN enabled, whitelist only vxlan_xmit, reproduce the original reproducer script, and confirm absence of data-race reports on the FDB fields; verify the annotated READ_ONCE/WRITE_ONCE macros are present in vxlan.c.
Typical attack path
- Create VXLAN interface and populate FDB entry
- Launch concurrent packet senders bound to the same VXLAN device on different CPUs
- Observe KCSAN reports on concurrent 'used'/'updated' accesses inside vxlan_xmit
How to detect it
Search kernel logs for KCSAN BUG reports mentioning vxlan_xmit and FDB fields; inspect system call traces containing repeated sendto operations on VXLAN sockets from multiple tasks.
What your security team should do
- Apply the listed kernel fix commit within standard change windows
- Monitor EPSS trend (currently stable at ~0.0022) for any future increase
- Include KCSAN runs in CI for networking stack changes
The record
In the Linux kernel, the following vulnerability has been resolved: vxlan: Annotate FDB data races The 'used' and 'updated' fields in the FDB entry structure can be accessed concurrently by multiple threads, leading to reports such as [1]. Can be reproduced using [2]. Suppress these reports by annotating these accesses using READ_ONCE() / WRITE_ONCE(). [1] BUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit write to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0: vxlan_xmit+0xb29/0x2380 dev_hard_start_xmit+0x84/0x2f0 __dev_queue_xmit+0x45a/0x1650 packet_xmit+0x100/0x150 packet_sendmsg+0x2114/0x2ac0 __sys_sendto+0x318/0x330 __x64_sys_sendto+0x76/0x90 x64_sys_call+0x14e8/0x1c00 do_syscall_64+0x9e/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2: vxlan_xmit+0xadf/0x2380 dev_hard_start_xmit+0x84/0x2f0 __dev_queue_xmit+0x45a/0x1650 packet_xmit+0x100/0x150 packet_sendmsg+0x2114/0x2ac0 __sys_sendto+0x318/0x330 __x64_sys_sendto+0x76/0x90 x64_sys_call+0x14e8/0x1c00 do_syscall_64+0x9e/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00000000fffbac6e -> 0x00000000fffbac6f Reported by Kernel Concurrency Sanitizer on: CPU: 2 UID: 0 PID: 287 Comm: mausezahn Not tainted 6.13.0-rc7-01544-gb4b270f11a02 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 [2] #!/bin/bash set +H echo whitelist > /sys/kernel/debug/kcsan echo !vxlan_xmit > /sys/kernel/debug/kcsan ip link add name vx0 up type vxlan id 10010 dstport 4789 local 192.0.2.1 bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 198.51.100.1 taskset -c 0 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q & taskset -c 2 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q &
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | linux | 0 | No fix |
| Debian:12 | linux | 0 | No fix |
| Debian:13 | linux | 0 | 6.12.32-1 |
| Debian:14 | linux | 0 | 6.12.32-1 |
| Linux | Kernel | 3.7.0 | 5.4.294 |
Related vulnerabilities
- CVE-2025-39885 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive… Also affects linux
- CVE-2025-39883 In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure… Also affects linux
- CVE-2025-39876 In the Linux kernel, the following vulnerability has been resolved: net: fec: Fix… Also affects linux
- CVE-2025-39869 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma… Also affects linux
- CVE-2025-39873 In the Linux kernel, the following vulnerability has been resolved: can: xilinx_can… Also affects linux
- CVE-2025-39863 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix… Also affects linux
- CVE-2025-39865 In the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer… Also affects linux
- CVE-2025-39866 In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix… Also affects linux