{"id":"DEBIAN-CVE-2025-38037","details":"In the Linux kernel, the following vulnerability has been resolved:  vxlan: Annotate FDB data races  The 'used' and 'updated' fields in the FDB entry structure can be accessed concurrently by multiple threads, leading to reports such as [1]. Can be reproduced using [2].  Suppress these reports by annotating these accesses using READ_ONCE() / WRITE_ONCE().  [1] BUG: KCSAN: data-race in vxlan_xmit / vxlan_xmit  write to 0xffff942604d263a8 of 8 bytes by task 286 on cpu 0:  vxlan_xmit+0xb29/0x2380  dev_hard_start_xmit+0x84/0x2f0  __dev_queue_xmit+0x45a/0x1650  packet_xmit+0x100/0x150  packet_sendmsg+0x2114/0x2ac0  __sys_sendto+0x318/0x330  __x64_sys_sendto+0x76/0x90  x64_sys_call+0x14e8/0x1c00  do_syscall_64+0x9e/0x1a0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  read to 0xffff942604d263a8 of 8 bytes by task 287 on cpu 2:  vxlan_xmit+0xadf/0x2380  dev_hard_start_xmit+0x84/0x2f0  __dev_queue_xmit+0x45a/0x1650  packet_xmit+0x100/0x150  packet_sendmsg+0x2114/0x2ac0  __sys_sendto+0x318/0x330  __x64_sys_sendto+0x76/0x90  x64_sys_call+0x14e8/0x1c00  do_syscall_64+0x9e/0x1a0  entry_SYSCALL_64_after_hwframe+0x77/0x7f  value changed: 0x00000000fffbac6e -\u003e 0x00000000fffbac6f  Reported by Kernel Concurrency Sanitizer on: CPU: 2 UID: 0 PID: 287 Comm: mausezahn Not tainted 6.13.0-rc7-01544-gb4b270f11a02 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-3.fc41 04/01/2014  [2]  #!/bin/bash   set +H  echo whitelist \u003e /sys/kernel/debug/kcsan  echo !vxlan_xmit \u003e /sys/kernel/debug/kcsan   ip link add name vx0 up type vxlan id 10010 dstport 4789 local 192.0.2.1  bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 198.51.100.1  taskset -c 0 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q &  taskset -c 2 mausezahn vx0 -a own -b 00:11:22:33:44:55 -c 0 -q &","modified":"2026-09-01T16:06:13.414107992Z","published":"2025-06-18T10:15:36.030Z","upstream":["CVE-2025-38037"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2025-38037"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.147-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38037.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.32-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38037.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.32-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2025-38037.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}