In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: fix region locking in hash types
Region locking introduced in v5.6-rc4 contained three macros to handle the region locks: ahashbucketstart(), ahashbucketend() which gave back the start and end hash bucket values belonging to a given region lock and ahash_region() which should give back the region lock belonging to a given hash bucket. The latter was incorrect which can lead to a race condition between the garbage collector and adding new elements when a hash type of set is defined with timeouts.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/37xxx/CVE-2025-37997.json"
}[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"210667614712464639247294581553758282194",
"112068290472881093384120978491615852632",
"168329650616812951775608535371078070135",
"299409686308420453509574882516688448608"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2ab67672b2288521a6146034a971f9a82ffc5c5",
"deprecated": false,
"id": "CVE-2025-37997-13e1731f",
"signature_type": "Line",
"target": {
"file": "net/netfilter/ipset/ip_set_hash_gen.h"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"210667614712464639247294581553758282194",
"112068290472881093384120978491615852632",
"168329650616812951775608535371078070135",
"299409686308420453509574882516688448608"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e002ecc1c8cfdfc866b9104ab7888da54613e59",
"deprecated": false,
"id": "CVE-2025-37997-1e0e36f3",
"signature_type": "Line",
"target": {
"file": "net/netfilter/ipset/ip_set_hash_gen.h"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"210667614712464639247294581553758282194",
"112068290472881093384120978491615852632",
"168329650616812951775608535371078070135",
"299409686308420453509574882516688448608"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a3dfec485401943e315c394c29afe2db8f9481d6",
"deprecated": false,
"id": "CVE-2025-37997-543a323a",
"signature_type": "Line",
"target": {
"file": "net/netfilter/ipset/ip_set_hash_gen.h"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"210667614712464639247294581553758282194",
"112068290472881093384120978491615852632",
"168329650616812951775608535371078070135",
"299409686308420453509574882516688448608"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@226ce0ec38316d9e3739e73a64b6b8304646c658",
"deprecated": false,
"id": "CVE-2025-37997-7a8c9ee2",
"signature_type": "Line",
"target": {
"file": "net/netfilter/ipset/ip_set_hash_gen.h"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"210667614712464639247294581553758282194",
"112068290472881093384120978491615852632",
"168329650616812951775608535371078070135",
"299409686308420453509574882516688448608"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8478a729c0462273188263136880480729e9efca",
"deprecated": false,
"id": "CVE-2025-37997-8b3f37fa",
"signature_type": "Line",
"target": {
"file": "net/netfilter/ipset/ip_set_hash_gen.h"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"210667614712464639247294581553758282194",
"112068290472881093384120978491615852632",
"168329650616812951775608535371078070135",
"299409686308420453509574882516688448608"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@00cfc5fad1491796942a948808afb968a0a3f35b",
"deprecated": false,
"id": "CVE-2025-37997-a2bffeaf",
"signature_type": "Line",
"target": {
"file": "net/netfilter/ipset/ip_set_hash_gen.h"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"210667614712464639247294581553758282194",
"112068290472881093384120978491615852632",
"168329650616812951775608535371078070135",
"299409686308420453509574882516688448608"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@aa77294b0f73bb8265987591460cd25b8722c3df",
"deprecated": false,
"id": "CVE-2025-37997-ba9cf51a",
"signature_type": "Line",
"target": {
"file": "net/netfilter/ipset/ip_set_hash_gen.h"
},
"signature_version": "v1"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"210667614712464639247294581553758282194",
"112068290472881093384120978491615852632",
"168329650616812951775608535371078070135",
"299409686308420453509574882516688448608"
]
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82c1eb32693bc48251d92532975e19160987e5b9",
"deprecated": false,
"id": "CVE-2025-37997-f80bc416",
"signature_type": "Line",
"target": {
"file": "net/netfilter/ipset/ip_set_hash_gen.h"
},
"signature_version": "v1"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-37997.json"