CVE-2025-37998: Linux kernel · openvswitch: Fix unsafe attribute parsing in output_userspace()
Affects Linux kernelSource CVE Database V5
Not known to be exploited.
Data as of 26 Oct 2026, 13:47 UTC
Rated High by the CNA (Linux) · No CVSS score from NVD or the CNA
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 18% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Exploitation evidence
Disclosed: evidence found.
CVE published 29 May 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
European organizations should prioritize applying the official Linux kernel patch that replaces manual Netlink attribute parsing with the safer nla_for_each_nested() macro in Open vSwitch. This involves updating to the latest kernel versions that include the fix or backporting the patch to supported kernel releases. Network administrators should audit their environments to identify systems running vulnerable kernel versions with Open vSwitch enabled. Implementing strict network segmentation and limiting access to management interfaces can reduce the attack surface. Monitoring kernel logs and network traffic for anomalous Netlink messages may help detect exploitation attempts. Additionally, organizations should maintain robust incident response plans to quickly address any exploitation. Regularly updating and patching Linux systems, especially those exposed to untrusted networks, is critical. Where immediate patching is not feasible, consider temporarily disabling or restricting Open vSwitch usage or employing compensating controls such as enhanced firewall rules and network access controls.
Description
In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix unsafe attribute parsing in output_userspace() This patch replaces the manual Netlink attribute iteration in output_userspace() with nla_for_each_nested(), which ensures that only well-formed attributes are processed.
References
- git.kernel.org/stable/c/6712dc21506738f5f22b4f68b7c0d9e0df819dbd (opens in a new tab)
- git.kernel.org/stable/c/06b4f110c79716c181a8c5da007c259807840232 (opens in a new tab)
- git.kernel.org/stable/c/47f7f00cf2fa3137d5c0416ef1a71bdf77901395 (opens in a new tab)
- git.kernel.org/stable/c/bca8df998cce1fead8cbc69144862eadc2e34c87 (opens in a new tab)
- git.kernel.org/stable/c/0236742bd959332181c1fcc41a05b7b709180501 (opens in a new tab)
- git.kernel.org/stable/c/ec334aaab74705cc515205e1da3cb369fdfd93cd (opens in a new tab)
- git.kernel.org/stable/c/4fa672cbce9c86c3efb8621df1ae580d47813430 (opens in a new tab)
- git.kernel.org/stable/c/6beb6835c1fbb3f676aebb51a5fee6b77fed9308 (opens in a new tab)