In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix nested key length validation in the set() action

It's not safe to access nla_len(ovs_key) if the data is smaller than
the netlink header. Check that the attribute is OK first.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00025.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
ccb1352e76cff0524e7ccb2074826a092dd13016 affected < 54c6957d1123a2032099b9eab51c314800f677ce
ccb1352e76cff0524e7ccb2074826a092dd13016 affected < 7fcaec0b2ab8fa5fbf0b45e5512364a168f445bd
ccb1352e76cff0524e7ccb2074826a092dd13016 affected < a27526e6b48eee9e2d82efff502c4f272f1a91d4
ccb1352e76cff0524e7ccb2074826a092dd13016 affected < 1489c195c8eecd262aa6712761ba5288203e28ec
ccb1352e76cff0524e7ccb2074826a092dd13016 affected < 824a7c2df5127b2402b68a21a265d413e78dcad7
ccb1352e76cff0524e7ccb2074826a092dd13016 affected < be80768d4f3b6fd13f421451cc3fee8778aba8bc
ccb1352e76cff0524e7ccb2074826a092dd13016 affected < 03d7262dd53e8c404da35cc81aaa887fd901f76b
ccb1352e76cff0524e7ccb2074826a092dd13016 affected < 65d91192aa66f05710cfddf6a14b5a25ee554dba
Linux Linux affected
Version Status Constraints
3.3 affected —
0 unaffected < 3.3
5.4.293 unaffected ≤ 5.4.*
5.10.237 unaffected ≤ 5.10.*
5.15.181 unaffected ≤ 5.15.*
6.1.135 unaffected ≤ 6.1.*
6.6.88 unaffected ≤ 6.6.*
6.12.25 unaffected ≤ 6.12.*
6.14.4 unaffected ≤ 6.14.*
6.15 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*

Configuration 2 [-]

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Debian Subscribe
Debian Linux Subscribe
Linux Subscribe
Linux Kernel Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4178-1 linux security update
Debian DLA Debian DLA DLA-4193-1 linux-6.1 security update
EUVD EUVD EUVD-2025-13015 In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first.
Ubuntu USN Ubuntu USN USN-7594-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7594-2 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-7594-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7654-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7654-2 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-7654-3 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7654-4 Linux kernel (KVM) vulnerabilities
Ubuntu USN Ubuntu USN USN-7654-5 Linux kernel (Xilinx ZynqMP) vulnerabilities
Ubuntu USN Ubuntu USN USN-7655-1 Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN Ubuntu USN USN-7686-1 Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN Ubuntu USN USN-7711-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-7712-1 Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7712-2 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-2 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-8031-1 Linux kernel (GCP) vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-3 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-4 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-5 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8031-2 Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-6 Linux kernel (HWE) vulnerabilities
Ubuntu USN Ubuntu USN USN-8031-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8052-1 Linux kernel (Low Latency) vulnerabilities
Ubuntu USN Ubuntu USN USN-8028-7 Linux kernel (Low Latency NVIDIA) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/03d7262dd53e8c404da35cc81aaa887fd901f76b cve-icon cve-icon
https://git.kernel.org/stable/c/1489c195c8eecd262aa6712761ba5288203e28ec cve-icon cve-icon
https://git.kernel.org/stable/c/54c6957d1123a2032099b9eab51c314800f677ce cve-icon cve-icon
https://git.kernel.org/stable/c/65d91192aa66f05710cfddf6a14b5a25ee554dba cve-icon cve-icon
https://git.kernel.org/stable/c/7fcaec0b2ab8fa5fbf0b45e5512364a168f445bd cve-icon cve-icon
https://git.kernel.org/stable/c/824a7c2df5127b2402b68a21a265d413e78dcad7 cve-icon cve-icon
https://git.kernel.org/stable/c/a27526e6b48eee9e2d82efff502c4f272f1a91d4 cve-icon cve-icon
https://git.kernel.org/stable/c/be80768d4f3b6fd13f421451cc3fee8778aba8bc cve-icon cve-icon
https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html cve-icon
https://lists.debian.org/debian-lts-announce/2025/05/msg00045.html cve-icon
https://lore.kernel.org/linux-cve-announce/2025050119-CVE-2025-37789-3f0b@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-37789 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-37789 cve-icon
History

Thu, 06 Nov 2025 17:30:00 +0000

Type Values Removed Values Added
First Time appeared Debian
Debian debian Linux
Linux
Linux linux Kernel
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.15:rc2:*:*:*:*:*:*
Vendors & Products Debian
Debian debian Linux
Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}

 cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Mon, 03 Nov 2025 20:30:00 +0000

Type Values Removed Values Added
References

Sat, 31 May 2025 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-20
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L'}

Fri, 02 May 2025 14:45:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 02 May 2025 06:30:00 +0000

Type Values Removed Values Added
References

Thu, 01 May 2025 13:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first.
Title net: openvswitch: fix nested key length validation in the set() action
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-11-03T19:55:14.808Z

Reserved: 2025-04-16T04:51:23.940Z

Link: CVE-2025-37789

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2025-05-01T14:15:43.290

Modified: 2025-11-06T17:27:39.670

Link: CVE-2025-37789

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-05-01T00:00:00Z

Links: CVE-2025-37789 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses