GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-37997 (GCVE-0-2025-37997)

Vulnerability from cvelistv5 – Published: 2025-05-29 13:15 – Updated: 2026-08-05 11:58
VLAI
Title
netfilter: ipset: fix region locking in hash types
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types Region locking introduced in v5.6-rc4 contained three macros to handle the region locks: ahash_bucket_start(), ahash_bucket_end() which gave back the start and end hash bucket values belonging to a given region lock and ahash_region() which should give back the region lock belonging to a given hash bucket. The latter was incorrect which can lead to a race condition between the garbage collector and adding new elements when a hash type of set is defined with timeouts.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5dd9488ae41070b69d2f4acb580f77db5705f9ca , < 00cfc5fad1491796942a948808afb968a0a3f35b (git)
Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < 226ce0ec38316d9e3739e73a64b6b8304646c658 (git)
Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < 82c1eb32693bc48251d92532975e19160987e5b9 (git)
Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < aa77294b0f73bb8265987591460cd25b8722c3df (git)
Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < a3dfec485401943e315c394c29afe2db8f9481d6 (git)
Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < e2ab67672b2288521a6146034a971f9a82ffc5c5 (git)
Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < 6e002ecc1c8cfdfc866b9104ab7888da54613e59 (git)
Affected: f66ee0410b1c3481ee75e5db9b34547b4d582465 , < 8478a729c0462273188263136880480729e9efca (git)
Affected: a469bab3386aebff33c59506f3a95e35b91118fd (git)
Affected: 5.4.24 , < 5.4.294 (semver)
Affected: 5.5.8 , < 5.6 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.4.294 , ≤ 5.4.* (semver)
Unaffected: 5.10.238 , ≤ 5.10.* (semver)
Unaffected: 5.15.183 , ≤ 5.15.* (semver)
Unaffected: 6.1.139 , ≤ 6.1.* (semver)
Unaffected: 6.6.91 , ≤ 6.6.* (semver)
Unaffected: 6.12.29 , ≤ 6.12.* (semver)
Unaffected: 6.14.7 , ≤ 6.14.* (semver)
Unaffected: 6.15 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T19:58:10.817Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_hash_gen.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "00cfc5fad1491796942a948808afb968a0a3f35b",
              "status": "affected",
              "version": "5dd9488ae41070b69d2f4acb580f77db5705f9ca",
              "versionType": "git"
            },
            {
              "lessThan": "226ce0ec38316d9e3739e73a64b6b8304646c658",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "82c1eb32693bc48251d92532975e19160987e5b9",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "aa77294b0f73bb8265987591460cd25b8722c3df",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "a3dfec485401943e315c394c29afe2db8f9481d6",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "e2ab67672b2288521a6146034a971f9a82ffc5c5",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "6e002ecc1c8cfdfc866b9104ab7888da54613e59",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "lessThan": "8478a729c0462273188263136880480729e9efca",
              "status": "affected",
              "version": "f66ee0410b1c3481ee75e5db9b34547b4d582465",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "a469bab3386aebff33c59506f3a95e35b91118fd",
              "versionType": "git"
            },
            {
              "lessThan": "5.4.294",
              "status": "affected",
              "version": "5.4.24",
              "versionType": "semver"
            },
            {
              "lessThan": "5.6",
              "status": "affected",
              "version": "5.5.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/ipset/ip_set_hash_gen.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.294",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.139",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.29",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.14.*",
              "status": "unaffected",
              "version": "6.14.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.15",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.294",
                  "versionStartIncluding": "5.4.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.238",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.183",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.139",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.91",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.29",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.7",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.15",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: fix region locking in hash types\n\nRegion locking introduced in v5.6-rc4 contained three macros to handle\nthe region locks: ahash_bucket_start(), ahash_bucket_end() which gave\nback the start and end hash bucket values belonging to a given region\nlock and ahash_region() which should give back the region lock belonging\nto a given hash bucket. The latter was incorrect which can lead to a\nrace condition between the garbage collector and adding new elements\nwhen a hash type of set is defined with timeouts."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable add/del and GC paths are driven through the ipset nfnetlink/sockopt control plane, which requires a local socket (netfilter control plane = Local per kernel scoring convention). Remote packets can drive `mtype_add()` via the `xt_set` SET target, but only when the administrator has configured such a rule, so the base score uses the self-contained local path.\nAC:L - The attacker provisions both sides of the race: they choose `hashsize \u003e= 2048` (which is what breaks the modulo-vs-division region mapping) and a short `timeout` that pins the GC period to the `HZ/10` floor, then churn add/del indefinitely with roughly half of all operations taking the wrong region lock. No condition depends on attacker-uncontrollable state, and failed attempts are freely retriable.\nPR:L - Access is gated on `netlink_net_capable(skb, CAP_NET_ADMIN)` and `ns_capable(net-\u003euser_ns, CAP_NET_ADMIN)`, both evaluated against the network namespace\u0027s user namespace, so an unprivileged user obtains it with `unshare -Urn`; ipset state is fully per-netns, so the whole attack works inside the sandbox.\nUI:N - The attacker creates the set, generates the element churn, and the garbage collector fires automatically from a delayed work item. No victim action is involved at any point.\nS:U - The corruption is confined to the kernel heap and is exploited for privilege escalation within the same kernel security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - The unserialized GC/add race yields use-after-free of hbucket objects and of extension data freed by `ip_set_ext_destroy()`, and stale resurrected buckets let freed slab contents be read back to userspace via `ipset list`, giving an arbitrary-read primitive.\nI:H - GC\u0027s shrink path can copy more used entries than `tmp-\u003esize` accounts for when a concurrent `mtype_add()` bumps `n-\u003epos` under a different lock, producing a heap out-of-bounds write of attacker-controlled element bytes; the double `kfree_rcu()` on the same hbucket additionally corrupts the SLUB freelist, both of which are standard arbitrary-write/control-flow-hijack primitives.\nA:H - Enqueuing the same `rcu_head` twice corrupts the RCU callback list (cycle \u2192 hang in `rcu_do_batch`), and the double free plus out-of-bounds writes reliably produce slab corruption, oops, and panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:58:49.210Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/00cfc5fad1491796942a948808afb968a0a3f35b"
        },
        {
          "url": "https://git.kernel.org/stable/c/226ce0ec38316d9e3739e73a64b6b8304646c658"
        },
        {
          "url": "https://git.kernel.org/stable/c/82c1eb32693bc48251d92532975e19160987e5b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa77294b0f73bb8265987591460cd25b8722c3df"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3dfec485401943e315c394c29afe2db8f9481d6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2ab67672b2288521a6146034a971f9a82ffc5c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e002ecc1c8cfdfc866b9104ab7888da54613e59"
        },
        {
          "url": "https://git.kernel.org/stable/c/8478a729c0462273188263136880480729e9efca"
        }
      ],
      "title": "netfilter: ipset: fix region locking in hash types",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-37997",
    "datePublished": "2025-05-29T13:15:55.580Z",
    "dateReserved": "2025-04-16T04:51:23.976Z",
    "dateUpdated": "2026-08-05T11:58:49.210Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-37997",
      "date": "2026-09-16",
      "epss": "0.00168",
      "percentile": "0.06475"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:48:25.000Z",
      "cve": "CVE-2025-37997",
      "id": "msrc_CVE-2025-37997",
      "initial_release_date": "2025-05-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: ipset: fix region locking in hash types",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-37997.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-37997\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-05-29T14:15:36.317\",\"lastModified\":\"2026-07-30T06:22:43.087\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: ipset: fix region locking in hash types\\n\\nRegion locking introduced in v5.6-rc4 contained three macros to handle\\nthe region locks: ahash_bucket_start(), ahash_bucket_end() which gave\\nback the start and end hash bucket values belonging to a given region\\nlock and ahash_region() which should give back the region lock belonging\\nto a given hash bucket. The latter was incorrect which can lead to a\\nrace condition between the garbage collector and adding new elements\\nwhen a hash type of set is defined with timeouts.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: netfilter: ipset: correcci\u00f3n del bloqueo de regi\u00f3n en tipos hash. El bloqueo de regi\u00f3n introducido en la versi\u00f3n v5.6-rc4 conten\u00eda tres macros para gestionar los bloqueos de regi\u00f3n: ahash_bucket_start(), ahash_bucket_end(), que devolv\u00eda los valores de inicio y fin del dep\u00f3sito hash correspondientes a un bloqueo de regi\u00f3n determinado, y ahash_region(), que deber\u00eda devolver el bloqueo de regi\u00f3n correspondiente a un dep\u00f3sito hash determinado. Esta \u00faltima era incorrecta, lo que puede generar una condici\u00f3n de ejecuci\u00f3n entre el recolector de elementos no utilizados y la adici\u00f3n de nuevos elementos cuando se define un tipo hash de conjunto con tiempos de espera.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/ipset/ip_set_hash_gen.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5dd9488ae41070b69d2f4acb580f77db5705f9ca\",\"lessThan\":\"00cfc5fad1491796942a948808afb968a0a3f35b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66ee0410b1c3481ee75e5db9b34547b4d582465\",\"lessThan\":\"226ce0ec38316d9e3739e73a64b6b8304646c658\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66ee0410b1c3481ee75e5db9b34547b4d582465\",\"lessThan\":\"82c1eb32693bc48251d92532975e19160987e5b9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66ee0410b1c3481ee75e5db9b34547b4d582465\",\"lessThan\":\"aa77294b0f73bb8265987591460cd25b8722c3df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66ee0410b1c3481ee75e5db9b34547b4d582465\",\"lessThan\":\"a3dfec485401943e315c394c29afe2db8f9481d6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66ee0410b1c3481ee75e5db9b34547b4d582465\",\"lessThan\":\"e2ab67672b2288521a6146034a971f9a82ffc5c5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66ee0410b1c3481ee75e5db9b34547b4d582465\",\"lessThan\":\"6e002ecc1c8cfdfc866b9104ab7888da54613e59\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f66ee0410b1c3481ee75e5db9b34547b4d582465\",\"lessThan\":\"8478a729c0462273188263136880480729e9efca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a469bab3386aebff33c59506f3a95e35b91118fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.4.24\",\"lessThan\":\"5.4.294\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.5.8\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/ipset/ip_set_hash_gen.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.294\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.238\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.183\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.139\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.91\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.29\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14.7\",\"lessThanOrEqual\":\"6.14.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.15\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4.24\",\"versionEndExcluding\":\"5.4.294\",\"matchCriteriaId\":\"FB89D6F8-FCFA-4003-8BAF-21EAA9437EEC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5.8\",\"versionEndExcluding\":\"5.6\",\"matchCriteriaId\":\"E3C9E794-4183-4A8B-8E8E-FBBD9B334429\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.6.1\",\"versionEndExcluding\":\"5.10.238\",\"matchCriteriaId\":\"C0C9C873-9D1C-4943-9A1F-755B15F4C242\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.183\",\"matchCriteriaId\":\"94D91ED4-346E-41EE-ACF5-F184C0A863D5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.139\",\"matchCriteriaId\":\"70A2F216-574B-4B80-86BC-988928D5B83D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.91\",\"matchCriteriaId\":\"B6826C73-C5C9-430D-84C9-4045DFD72074\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.29\",\"matchCriteriaId\":\"7215ABCF-8EB1-46CD-8872-8BCE4890E579\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.14.7\",\"matchCriteriaId\":\"5715A6F5-A34A-4B27-8A64-82825E963995\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.6:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A92F7A0E-C302-4FEA-9EF3-1A3D5CF3AD54\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.6:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC0C894E-6323-44E5-89DD-8FB6A5C41CAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.6:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C76EAC9-C2E6-4B6F-B002-ADBE74DDD794\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.6:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"F13B8FBF-E007-4F60-A290-2833B45F8520\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.6:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD0276C4-2C60-4C52-AC89-F96DF991B858\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D465631-2980-487A-8E65-40AE2B9F8ED1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C9D071F-B28E-46EC-AC61-22B913390211\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D240580-3048-49B2-9E27-F115A9DF8224\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/00cfc5fad1491796942a948808afb968a0a3f35b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/226ce0ec38316d9e3739e73a64b6b8304646c658\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6e002ecc1c8cfdfc866b9104ab7888da54613e59\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/82c1eb32693bc48251d92532975e19160987e5b9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8478a729c0462273188263136880480729e9efca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a3dfec485401943e315c394c29afe2db8f9481d6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aa77294b0f73bb8265987591460cd25b8722c3df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e2ab67672b2288521a6146034a971f9a82ffc5c5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T09:23:41+00:00",
      "cve": "CVE-2025-37997",
      "id": "CVE-2025-37997",
      "initial_release_date": "2025-05-29T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: ipset: fix region locking in hash types",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-37997.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-12T16:50:16Z",
      "cve": "CVE-2025-37997",
      "id": "CVE-2025-37997",
      "initial_release_date": "2025-05-30T01:26:33Z",
      "product_status:known_affected": "387",
      "product_status:known_not_affected": "276",
      "product_status:recommended": "669",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-37997",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-37997.json",
      "version": "49"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.