Answer in brief
CVE-2025-38037 records a Medium severity (CVSS 5.5) vulnerability in vxlan: Annotate FDB data races. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d342894c5d2f8c7df194c793ec4059656e09ca31 <02a33b1035a307453a1da6ce0a1bf3676be287d7 || >=d342894c5d2f8c7df194c793ec4059656e09ca31 <87d076987a9ba106c83412fcd113656f71af05a1 || >=d342894c5d2f8c7df194c793ec4059656e09ca31 <e033da39fc6abbddab6c29624acef80757f273fa || >=d342894c5d2f8c7df194c793ec4059656e09ca31 <784b78295a3a58bf052339dd669e6e03710220d3 || >=d342894c5d2f8c7df194c793ec4059656e09ca31 <13cba3f837903f7184d6e9b6137d5165ffe82a8f || >=d342894c5d2f8c7df194c793ec4059656e09ca31 <a6644aeb8ddf196dec5f8e782293c36f065df4d7 || >=d342894c5d2f8c7df194c793ec4059656e09ca31 <4eceb7eae6ea7c950384c34e6dbbe872c981935f || >=d342894c5d2f8c7df194c793ec4059656e09ca31 <f6205f8215f12a96518ac9469ff76294ae7bd612 | 02a33b1035a307453a1da6ce0a1bf3676be287d7, 87d076987a9ba106c83412fcd113656f71af05a1, e033da39fc6abbddab6c29624acef80757f273fa, 784b78295a3a58bf052339dd669e6e03710220d3, 13cba3f837903f7184d6e9b6137d5165ffe82a8f, a6644aeb8ddf196dec5f8e782293c36f065df4d7, 4eceb7eae6ea7c950384c34e6dbbe872c981935f, f6205f8215f12a96518ac9469ff76294ae7bd612 |
| Linux/Linuxgeneric | 3.7 | Not reported |
Published upstream
Jun 18, 2025
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 5, 2026
In the Linux kernel, the following vulnerability has been resolved: vxlan: Annotate FDB data races The 'used' and 'updated' fields in the FDB entry structure can be accessed concurrently by multiple threads, leading to reports such as [1]. Can be reproduced using [2]. Suppress these reports by annotating these accesses using READ_ONCE() / WRITE_ONCE(). [1] BUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit write to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0: vxlan_xmit+0xb29/0x2380 dev_hard_start_xmit+0x84/0x2f0 __dev_queue_xmit+0x45a/0x1650 packet_xmit+0x100/0x150 packet_sendmsg+0x2114/0x2ac0 __sys_sendto+0x318/0x330 __x64_sys_sendto+0x76/0x90 x64_sys_call+0x14e8/0x1c00 do_syscall_64+0x9e/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f read to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2: vxlan_xmit+0xadf/0x2380 dev_hard_start_xmit+0x84/0x2f0 __dev_queue_xmit+0x45a/0x1650 packet_xmit+0x100/0x150 packet_sendmsg+0x2114/0x2ac0 __sys_sendto+0x318/0x330 __x64_sys_sendto+0x76/0x90 x64_sys_call+0x14e8/0x1c00 do_syscall_64+0x9e/0x1a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f value changed: 0x00000000fffbac6e -> 0x00000000fffbac6f Reported by Kernel Concurrency Sanitizer on: CPU: 2 UID: 0 PID: 287 Comm: mausezahn Not tainted 6.13.0-rc7-01544-gb4b270f11a02 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014 [2] #!/bin/bash set +H echo whitelist > /sys/kernel/debug/kcsan echo !vxlan_xmit > /sys/kernel/debug/kcsan ip link add name vx0 up type vxlan id 10010 dstport 4789 local 192.0.2.1 bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 198.51.100.1 taskset -c 0 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q & taskset -c 2 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q &
Quoted source text, attributed separately from HOL analysis.