CVE-2025-37789: net: openvswitch: fix nested key length validation in the set() action
In the Linux kernel, the following vulnerability has been resolved:
net: openvswitch: fix nested key length validation in the set() action
It's not safe to access nlalen(ovskey) if the data is smaller than the netlink header. Check that the attribute is OK first.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-37789?
CVE-2025-37789 has been classified as a medium severity vulnerability due to its potential impact on kernel data integrity.
How do I fix CVE-2025-37789?
To fix CVE-2025-37789, update to the latest version of the Linux kernel or Open vSwitch where the vulnerability has been addressed.
Which versions of software are affected by CVE-2025-37789?
CVE-2025-37789 affects specific versions of the Linux kernel and all versions of Open vSwitch using the vulnerable code.
What components are impacted by CVE-2025-37789?
CVE-2025-37789 specifically impacts the netlink interface in the Linux kernel related to Open vSwitch.
Is CVE-2025-37789 being actively exploited?
As of the current reports, there is no indication that CVE-2025-37789 is actively being exploited in the wild.