CVE-2025-37997VulnerabilityPublished 29 May 2025Updated 4 Jun 2025

CVE-2025-37997: Linux · Vulnerability

Affects LinuxSource CVE Database V5

Not known to be exploited.

Data as of 25 Oct 2026, 19:02 UTC

Severity

High

Rated High by the CNA (Linux) · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

Disclosed: evidence found.
CVE published 29 May 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched. Since the issue is in the ipset module's region locking, applying the official Linux kernel patches that fix the ahash_region() macro behavior is essential. Organizations should: 1) Identify all Linux systems running kernel versions affected by the listed commit hashes or versions prior to the fix. 2) Test and deploy updated kernel versions from trusted Linux distributions that incorporate the fix. 3) Temporarily disable or limit the use of ipset hash types with timeouts if patching cannot be immediately applied, to reduce exposure. 4) Monitor kernel logs and system behavior for anomalies indicating race conditions or crashes related to ipset operations. 5) Employ kernel hardening techniques such as Kernel Address Space Layout Randomization (KASLR) and Control Flow Integrity (CFI) to reduce exploitability. 6) Maintain strict access controls to prevent unprivileged users from manipulating ipset configurations or triggering the vulnerable code paths. 7) Engage with Linux distribution vendors and security mailing lists to stay informed about patch releases and exploit developments. These targeted actions go beyond generic advice by focusing on the specific kernel component and operational practices related to ipset usage.

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix region locking in hash types Region locking introduced in v5.6-rc4 contained three macros to handle the region locks: ahash_bucket_start(), ahash_bucket_end() which gave back the start and end hash bucket values belonging to a given region lock and ahash_region() which should give back the region lock belonging to a given hash bucket. The latter was incorrect which can lead to a race condition between the garbage collector and adding new elements when a hash type of set is defined with timeouts.

Impact

For European organizations, this vulnerability poses a significant risk especially for those relying on Linux-based infrastructure for network security, firewall management, and routing. Many enterprises, government agencies, and critical infrastructure providers in Europe use Linux servers and appliances that utilize ipset for efficient firewall rule management. Exploitation could lead to kernel crashes causing denial of service, potentially disrupting network security enforcement and exposing systems to further attacks. In worst cases, attackers might leverage this race condition to execute arbitrary code with kernel privileges, leading to full system compromise. This is particularly concerning for sectors such as finance, telecommunications, energy, and public administration where Linux servers are prevalent and uptime is critical. Additionally, the complexity of the vulnerability means that skilled attackers could develop exploits once the vulnerability details become widely known, increasing the threat over time. The absence of known exploits currently provides a window for proactive mitigation, but organizations must act swiftly to patch vulnerable systems to avoid exposure.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 7 Jul 2025, 19:56 UTC

Technical details

References

Community reviews

Related threats