LiveActive security incident?Get immediate response
CVE Record

CVE-2025-37997: netfilter: ipset: fix region locking in hash types

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types Region locking introduced in v5.6-rc4 contained three macros to handle the region locks: ahash_bucket_start(), ahash_bucket_end() which gave back the start and end hash bucket values belonging to a given region lock and ahash_region() which should give back the region lock belonging to a given hash bucket. The latter was incorrect which can lead to a race condition between the garbage collector and adding new elements when a hash type of set is defined with timeouts.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A flaw in Linux netfilter ipset locking can create a race when timeout-enabled hash sets are cleaned while new entries are added. The supplied CVSS 7.8 assessment indicates potentially severe confidentiality, integrity, and availability impact, but exploitation requires local, low-privileged access and the affected ipset configuration.

Executive priority

Treat as a high-priority local privilege boundary risk on multi-user or otherwise locally accessible Linux systems using the affected ipset feature. Patch promptly through supported vendor channels, while prioritizing confirmed timeout-enabled hash-set deployments. Emergency remote-service shutdown is not supported by the supplied evidence.

Technical view

The ahash_region() macro can select the wrong region lock for a hash bucket. This permits concurrent garbage collection and element insertion in hash-type ipsets configured with timeouts. The bundle identifies upstream stable fixes, but does not describe the resulting corruption mechanism or demonstrate exploitation.

Likely exposure

Exposure is limited to Linux systems running an affected or unpatched vendor kernel and using hash-type ipsets with timeouts. It is locally reachable rather than remotely network-exploitable according to the supplied CVSS vector. Because distributions may backport fixes, kernel version strings alone may not establish vulnerability.

Exploitation context

CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The CVSS vector describes low attack complexity, local access, low privileges, no user interaction, and potentially high impact across confidentiality, integrity, and availability.

Researcher notes

The defect originated with region locking introduced in v5.6-rc4. Incorrect bucket-to-region mapping can undermine synchronization between garbage collection and insertion. Eight stable-kernel commits are referenced. No CWE is supplied, and the flattened version data is insufficient to determine exact distribution-specific affected ranges without vendor backport verification.

Mitigation direction

  • Install a vendor-supported kernel containing the applicable upstream or backported fix.
  • Reboot into the updated kernel and verify the running build.
  • Prioritize systems using timeout-enabled hash-type ipsets or allowing low-privileged local access.
  • Consult distribution guidance before considering configuration changes; the bundle documents no validated workaround.

Validation and detection

  • Inventory running kernel builds and match them against vendor advisories and backport records.
  • Identify systems configuring netfilter ipset hash types with timeouts.
  • Confirm the patched kernel is active after reboot, not merely installed.
  • Retest firewall and ipset behavior after remediation.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-37997 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
11Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-37997Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5dd9488ae41070b69d2f4acb580f77db5705f9ca, f66ee0410b1c3481ee75e5db9b34547b4d582465, f66ee0410b1c3481ee75e5db9b34547b4d582465, f66ee0410b1c3481ee75e5db9b34547b4d582465, f66ee0410b1c3481ee75e5db9b34547b4d582465, f66ee0410b1c3481ee75e5db9b34547b4d582465, f66ee0410b1c3481ee75e5db9b34547b4d582465, f66ee0410b1c3481ee75e5db9b34547b4d582465, a469bab3386aebff33c59506f3a95e35b91118fd, 5.4.24, 5.5.8unaffected
LinuxLinux5.6, 0, 5.4.294, 5.10.238, 5.15.183, 6.1.139, 6.6.91, 6.12.29, 6.14.7, 6.15affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.