CVE-2025-37864

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: clean up FDB, MDB, VLAN entries on unbind

As explained in many places such as commit b117e1e8a86d ("net: dsa:

delete dsa_legacy_fdb_add and dsa_legacy_fdb_del"), DSA is written given

the assumption that higher layers have balanced additions/deletions.

As such, it only makes sense to be extremely vocal when those

assumptions are violated and the driver unbinds with entries still

present.

But Ido Schimmel points out a very simple situation where that is wrong:

https://lore.kernel.org/netdev/ZDazSM5UsPPjQuKr@shredder/

(also briefly discussed by me in the aforementioned commit).

Basically, while the bridge bypass operations are not something that DSA

explicitly documents, and for the majority of DSA drivers this API

simply causes them to go to promiscuous mode, that isn't the case for

all drivers. Some have the necessary requirements for bridge bypass

operations to do something useful - see dsa_switch_support

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References