Security readout for executives and security teams
Plain-English summary
A Linux VXLAN cleanup operation can remove a forwarding entry without the required lock when a VNI is deleted in vnifilter mode. This can trigger a kernel warning and indicates unsafe concurrent state handling. The supplied record rates it 7.8 high, but provides no evidence of remote or active exploitation.
Executive priority
Prioritize affected network infrastructure and virtualization hosts, but do not treat this as an internet-wide emergency based on current evidence. Patch through normal high-severity kernel maintenance, accelerating systems that permit delegated network administration or frequently change VXLAN VNIs.
Technical view
The flaw affects deletion of the default-remote FDB entry during VXLAN VNI removal in vnifilter mode. The kernel calls the deletion path without holding the FDB hash lock. Referenced stable changes acquire and release that lock around deletion. The supplied evidence demonstrates a lockdep warning, not a proven compromise or crash.
Likely exposure
Exposure is limited to affected Linux kernels using VXLAN vnifilter mode with a configured default remote, particularly where local users or services can modify VNI configuration. The CVSS vector describes local, low-privilege access, but the source bundle does not establish which real-world permission models make the operation reachable.
Exploitation context
CISA KEV status is false, and the supplied sources do not report active exploitation or a public weaponized exploit. Triggering requires a local VNI deletion under a specific VXLAN configuration. Although CVSS models high confidentiality, integrity, and availability impact, the provided technical evidence only confirms unsafe locking and a warning.
Researcher notes
The record attributes the issue to an original VXLAN vnifilter implementation and describes the repair as locking the FDB hash during deletion. No CWE is supplied. Exact vulnerable and fixed package boundaries remain distribution-dependent; repeated commit identifiers and unusual version entries in the bundle warrant validation against vendor advisories.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the applicable referenced stable fix.
- Consult the Linux distribution's advisory to map fixed commits to packaged kernel versions.
- Restrict authorization for creating, changing, or deleting VXLAN VNI configurations.
- Avoid unnecessary VNI deletion operations on exposed systems until remediation is applied.
Validation and detection
- Inventory Linux kernel builds on systems using VXLAN networking.
- Identify VXLAN devices operating in vnifilter mode with configured default remotes.
- Compare exact vendor kernel packages against vendor advisories and referenced stable fixes.
- Review kernel logs for warnings involving vxlan_find_mac or VXLAN VNI deletion.
- After updating, confirm the running kernel is the intended remediated build.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-37921 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2d4a121296aa3940d2df9906f955c2b6b4e38bc3CVE reference, Linux
- https://git.kernel.org/stable/c/3576e9a80b6c4381b01ce0cbaa07f5e92d4492edCVE reference, Linux
- https://git.kernel.org/stable/c/5cb9e07f84e527974b12e82e2549fa6c0cc6eef0CVE reference, Linux
- https://git.kernel.org/stable/c/470206205588559e60035fceb5f256640cb45f99CVE reference, Linux
- https://git.kernel.org/stable/c/087a9eb9e5978e3ba362e1163691e41097e8ca20CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/08/msg00010.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.