CVE-2025-37789

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-37789
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/03d7262dd53e8c404da35cc81aaa887fd901f76b Patch
https://git.kernel.org/stable/c/1489c195c8eecd262aa6712761ba5288203e28ec Patch
https://git.kernel.org/stable/c/54c6957d1123a2032099b9eab51c314800f677ce Patch
https://git.kernel.org/stable/c/65d91192aa66f05710cfddf6a14b5a25ee554dba Patch
https://git.kernel.org/stable/c/7fcaec0b2ab8fa5fbf0b45e5512364a168f445bd Patch
https://git.kernel.org/stable/c/824a7c2df5127b2402b68a21a265d413e78dcad7 Patch
https://git.kernel.org/stable/c/a27526e6b48eee9e2d82efff502c4f272f1a91d4 Patch
https://git.kernel.org/stable/c/be80768d4f3b6fd13f421451cc3fee8778aba8bc Patch
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html Mailing List Third Party Advisory
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
History

06 Nov 2025, 17:27

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux
Debian
Debian debian Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/03d7262dd53e8c404da35cc81aaa887fd901f76b - () https://git.kernel.org/stable/c/03d7262dd53e8c404da35cc81aaa887fd901f76b - Patch
References () https://git.kernel.org/stable/c/1489c195c8eecd262aa6712761ba5288203e28ec - () https://git.kernel.org/stable/c/1489c195c8eecd262aa6712761ba5288203e28ec - Patch
References () https://git.kernel.org/stable/c/54c6957d1123a2032099b9eab51c314800f677ce - () https://git.kernel.org/stable/c/54c6957d1123a2032099b9eab51c314800f677ce - Patch
References () https://git.kernel.org/stable/c/65d91192aa66f05710cfddf6a14b5a25ee554dba - () https://git.kernel.org/stable/c/65d91192aa66f05710cfddf6a14b5a25ee554dba - Patch
References () https://git.kernel.org/stable/c/7fcaec0b2ab8fa5fbf0b45e5512364a168f445bd - () https://git.kernel.org/stable/c/7fcaec0b2ab8fa5fbf0b45e5512364a168f445bd - Patch
References () https://git.kernel.org/stable/c/824a7c2df5127b2402b68a21a265d413e78dcad7 - () https://git.kernel.org/stable/c/824a7c2df5127b2402b68a21a265d413e78dcad7 - Patch
References () https://git.kernel.org/stable/c/a27526e6b48eee9e2d82efff502c4f272f1a91d4 - () https://git.kernel.org/stable/c/a27526e6b48eee9e2d82efff502c4f272f1a91d4 - Patch
References () https://git.kernel.org/stable/c/be80768d4f3b6fd13f421451cc3fee8778aba8bc - () https://git.kernel.org/stable/c/be80768d4f3b6fd13f421451cc3fee8778aba8bc - Patch
References () https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html - () https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html - Mailing List, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html - () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html - Mailing List, Third Party Advisory
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

03 Nov 2025, 20:18

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html -
  • () https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html -

02 May 2025, 13:53

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: openvswitch: corrección de la validación de la longitud de la clave anidada en la acción set(). No es seguro acceder a nla_len(ovs_key) si los datos son menores que el encabezado netlink. Compruebe primero que el atributo esté correcto.

02 May 2025, 07:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/54c6957d1123a2032099b9eab51c314800f677ce -
  • () https://git.kernel.org/stable/c/7fcaec0b2ab8fa5fbf0b45e5512364a168f445bd -
  • () https://git.kernel.org/stable/c/a27526e6b48eee9e2d82efff502c4f272f1a91d4 -

01 May 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 14:15

Updated : 2025-11-06 17:27

NVD link : CVE-2025-37789

Mitre link : CVE-2025-37789

CVE.ORG link : CVE-2025-37789

JSON object : View

Products Affected

debian

  • debian_linux

linux

  • linux_kernel
CWE
NVD-CWE-noinfo