CVE-2025-37959 is a vulnerability in the Linux kernel related to the handling of packet redirection across network namespaces using the eBPF helper function bpf_redirect_peer. Specifically, when bpf_redirect_peer redirects packets to a device in another network namespace, the socket buffer (skb) is not properly scrubbed. This improper scrubbing allows skb metadata, including extensions related to IPsec decryption states, to leak from one network namespace to another. The vulnerability manifests in scenarios such as containerized environments using Cilium for networking, where packets decrypted by IPsec on the host namespace are redirected to a container namespace. Because the skb retains host-side XFRM (transform) state information, the container namespace's XFRM policy check fails to find a matching policy, leading to unexpected packet drops. This behavior can disrupt network traffic flow and potentially cause denial of service within containerized or multi-tenant environments relying on network namespaces and IPsec. The patch for this vulnerability involves scrubbing the skb metadata during bpf_redirect_peer operations, similar to the scrubbing done during typical network namespace switches via veth devices, except that skb->mark and skb->tstamp are preserved. This fix prevents leakage of sensitive skb state information across namespaces, ensuring proper isolation and correct packet processing. The vulnerability affects Linux kernel versions identified by the commit hash 9aa1206e8f48222f35a0c809f33b2f4aaa1e2661 and was published on May 20, 2025. No known exploits are reported in the wild at this time, and no CVSS score has been assigned.

For European organizations, especially those deploying containerized applications using Kubernetes with Cilium or similar networking solutions, this vulnerability poses a risk of network disruption and denial of service. The leakage of skb metadata across network namespaces can cause legitimate traffic to be dropped unexpectedly, impacting application availability and reliability. Organizations relying on IPsec for secure communication within or between containers may experience degraded network performance or failures in packet delivery. This can affect cloud service providers, telecom operators, financial institutions, and enterprises with critical containerized workloads. Additionally, the vulnerability undermines network namespace isolation, which is fundamental for multi-tenant environments, potentially increasing the attack surface if combined with other vulnerabilities. While no direct data confidentiality or integrity compromise is indicated, the disruption of network traffic can have cascading effects on business operations and service-level agreements. The lack of known exploits suggests a window for proactive patching to prevent future exploitation.

European organizations should prioritize updating their Linux kernels to versions that include the patch for CVE-2025-37959. Specifically, kernel versions incorporating the commit identified by hash 9aa1206e8f48222f35a0c809f33b2f4aaa1e2661 or later should be deployed. For environments using Cilium or similar eBPF-based networking solutions, verify that the networking stack is compatible with the patched kernel and test thoroughly in staging before production rollout. Network administrators should audit their use of bpf_redirect_peer and related eBPF programs to ensure they do not rely on unpatched kernel behavior. Additionally, monitoring network namespaces for unexpected packet drops or anomalies in IPsec traffic can help detect issues related to this vulnerability. Employing strict network namespace isolation policies and minimizing cross-namespace packet redirection where possible reduces exposure. Finally, maintain up-to-date incident response plans to address potential network disruptions stemming from this or related vulnerabilities.