{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-37959", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.974Z", "datePublished": "2025-05-20T16:01:52.547Z", "dateUpdated": "2026-08-05T11:58:40.419Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:40.419Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Scrub packet on bpf_redirect_peer\n\nWhen bpf_redirect_peer is used to redirect packets to a device in\nanother network namespace, the skb isn't scrubbed. That can lead skb\ninformation from one namespace to be \"misused\" in another namespace.\n\nAs one example, this is causing Cilium to drop traffic when using\nbpf_redirect_peer to redirect packets that just went through IPsec\ndecryption to a container namespace. The following pwru trace shows (1)\nthe packet path from the host's XFRM layer to the container's XFRM\nlayer where it's dropped and (2) the number of active skb extensions at\neach function.\n\n NETNS MARK IFACE TUPLE FUNC\n 4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 xfrm_rcv_cb\n .active_extensions = (__u8)2,\n 4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 xfrm4_rcv_cb\n .active_extensions = (__u8)2,\n 4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 gro_cells_receive\n .active_extensions = (__u8)2,\n [...]\n 4026533547 0 eth0 10.244.3.124:35473->10.244.2.158:53 skb_do_redirect\n .active_extensions = (__u8)2,\n 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 ip_rcv\n .active_extensions = (__u8)2,\n 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 ip_rcv_core\n .active_extensions = (__u8)2,\n [...]\n 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 udp_queue_rcv_one_skb\n .active_extensions = (__u8)2,\n 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 __xfrm_policy_check\n .active_extensions = (__u8)2,\n 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 __xfrm_decode_session\n .active_extensions = (__u8)2,\n 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 security_xfrm_decode_session\n .active_extensions = (__u8)2,\n 4026534999 0 eth0 10.244.3.124:35473->10.244.2.158:53 kfree_skb_reason(SKB_DROP_REASON_XFRM_POLICY)\n .active_extensions = (__u8)2,\n\nIn this case, there are no XFRM policies in the container's network\nnamespace so the drop is unexpected. When we decrypt the IPsec packet,\nthe XFRM state used for decryption is set in the skb extensions. This\ninformation is preserved across the netns switch. When we reach the\nXFRM policy check in the container's netns, __xfrm_policy_check drops\nthe packet with LINUX_MIB_XFRMINNOPOLS because a (container-side) XFRM\npolicy can't be found that matches the (host-side) XFRM state used for\ndecryption.\n\nThis patch fixes this by scrubbing the packet when using\nbpf_redirect_peer, as is done on typical netns switches via veth\ndevices except skb->mark and skb->tstamp are not zeroed." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "baseScore": 9.4, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The defect is in `skb_do_redirect()` on the softirq packet-receive path in net/core/filter.c, and every piece of leaked state (conntrack entry, NAT binding, XFRM secpath, dst) is attached while processing a packet received from the network. In the real deployment for this helper — the Cilium/netkit container datapath — the attacker is simply a remote host sending traffic to a pod.\nAC:L - There is no race, no memory-layout dependency, and no unpredictable precondition: every packet redirected via `bpf_redirect_peer()` deterministically crosses the netns boundary with host-namespace metadata intact, because nothing on the `-EAGAIN`/`another_round` path clears it. The attacker only has to send traffic that reaches the tc-ingress redirect.\nPR:N - External traffic arriving at a NodePort/LoadBalancer or pod IP is conntracked and NAT'd in the host netns and then redirected into the container netns by the CNI's tc program without authenticating the sender. No credentials or account on the target node are required.\nUI:N - The redirect and the subsequent netfilter/XFRM evaluation in the destination namespace happen automatically in softirq context on packet receive. No local user, administrator, or victim action is involved.\nS:U - Both the vulnerable component (host-netns redirect path) and the impacted components (the destination netns's netfilter/XFRM/rp_filter state) are enforced by the same kernel security authority; no hypervisor, IOMMU, or address-space boundary is crossed.\nC:L - Host-namespace state becomes visible inside the container: the surviving conntrack entry exposes pre-DNAT original tuples (revealing internal backends), `ct mark`, `ct secmark` and expiry to container-side nftables, and the retained secpath delivers the host XFRM SA's LSM security context to container userspace via `SCM_SECURITY`. The exposure is structured and bounded rather than an arbitrary kernel memory read.\nI:H - Multiple security controls in the destination namespace are silently bypassed — reverse-path filtering is disabled by the stale secpath in `fib_validate_source()`, `nf_conntrack_in()` short-circuits so the container's stateful firewall/network-policy `ct state` rules match a foreign entry, and `nf_nat_inet_fn()` applies the host's NAT binding instead of the container's own `DNAT`/`REDIRECT` interception rules; conversely container-side `nft_ct` can write `ct mark`/`ct secmark` onto a host-namespace conntrack object that drives host policy routing and SELinux packet decisions.\nA:H - The commit documents the confirmed real-world effect: the leaked secpath makes `__xfrm_policy_check()` drop packets with `LINUX_MIB_XFRMINNOPOLS` in a container that has no XFRM policy, producing sustained and total loss of network connectivity for affected containers. This is a persistent denial of the pod's network service, not mere degradation." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/filter.c" ], "versions": [ { "version": "9aa1206e8f48222f35a0c809f33b2f4aaa1e2661", "lessThan": "de1067cc8cf0e8c11ae20cbe5c467aef19d04ded", "status": "affected", "versionType": "git" }, { "version": "9aa1206e8f48222f35a0c809f33b2f4aaa1e2661", "lessThan": "355b0526336c0bf2bf7feaca033568ede524f763", "status": "affected", "versionType": "git" }, { "version": "9aa1206e8f48222f35a0c809f33b2f4aaa1e2661", "lessThan": "b37e54259cab4f78b53953d6f6268b85f07bef3e", "status": "affected", "versionType": "git" }, { "version": "9aa1206e8f48222f35a0c809f33b2f4aaa1e2661", "lessThan": "9e15ef33ba39fb6d9d1f51445957f16983a9437a", "status": "affected", "versionType": "git" }, { "version": "9aa1206e8f48222f35a0c809f33b2f4aaa1e2661", "lessThan": "c4327229948879814229b46aa26a750718888503", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/core/filter.c" ], "versions": [ { "version": "5.10", "status": "affected" }, { "version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.139", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.91", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.29", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.7", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.139" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.91" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12.29" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.14.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/de1067cc8cf0e8c11ae20cbe5c467aef19d04ded" }, { "url": "https://git.kernel.org/stable/c/355b0526336c0bf2bf7feaca033568ede524f763" }, { "url": "https://git.kernel.org/stable/c/b37e54259cab4f78b53953d6f6268b85f07bef3e" }, { "url": "https://git.kernel.org/stable/c/9e15ef33ba39fb6d9d1f51445957f16983a9437a" }, { "url": "https://git.kernel.org/stable/c/c4327229948879814229b46aa26a750718888503" } ], "title": "bpf: Scrub packet on bpf_redirect_peer", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/08/msg00010.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T19:57:44.271Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-07-14T12:41:15.298Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" }, { "vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [ { "status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html" } ] } ] } }