CVE-2025-37786

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: free routing table on probe failure

If complete = true in dsa_tree_setup(), it means that we are the last

switch of the tree which is successfully probing, and we should be

setting up all switches from our probe path.

After "complete" becomes true, dsa_tree_setup_cpu_ports() or any

subsequent function may fail. If that happens, the entire tree setup is

in limbo: the first N-1 switches have successfully finished probing

(doing nothing but having allocated persistent memory in the tree's

dst->ports, and maybe dst->rtable), and switch N failed to probe, ending

the tree setup process before anything is tangible from the user's PoV.

If switch N fails to probe, its memory (ports) will be freed and removed

from dst->ports. However, the dst->rtable elements pointing to its ports,

as created by dsa_link_touch(), will remain there, and will lead to

use-after-free if dereferenced.

If dsa_tree_setup_switches() retur

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References