CVE-2025-38037

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: Annotate FDB data races

The 'used' and 'updated' fields in the FDB entry structure can be

accessed concurrently by multiple threads, leading to reports such as

[1]. Can be reproduced using [2].

Suppress these reports by annotating these accesses using

READ_ONCE() / WRITE_ONCE().

[1]

BUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit

write to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0:

vxlan_xmit+0xb29/0x2380

dev_hard_start_xmit+0x84/0x2f0

__dev_queue_xmit+0x45a/0x1650

packet_xmit+0x100/0x150

packet_sendmsg+0x2114/0x2ac0

__sys_sendto+0x318/0x330

__x64_sys_sendto+0x76/0x90

x64_sys_call+0x14e8/0x1c00

do_syscall_64+0x9e/0x1a0

entry_SYSCALL_64_after_hwframe+0x77/0x7f

read to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2:

vxlan_xmit+0xadf/0x2380

dev_hard_start_xmit+0x84/0x2f0

__dev_queue_xmit+0x45a/0x1650

packet_xmit+0x100/0x150

packet_sendmsg+0x2114/0x2ac0

__sys_sendto+0x318/0x330

__

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References