CVE-2025-37997

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix region locking in hash types

Region locking introduced in v5.6-rc4 contained three macros to handle the region locks: ahash_bucket_start(), ahash_bucket_end() which gave back the start and end hash bucket values belonging to a given region lock and ahash_region() which should give back the region lock belonging to a given hash bucket. The latter was incorrect which can lead to a race condition between the garbage collector and adding new elements when a hash type of set is defined with timeouts.

This vulnerability is rated as having a Moderate impact for Red Hat Enterprise Linux because exploitation requires local network administrative privileges or access to unprivileged user namespaces and only affects hash sets configured with entry timeouts. The flaw stems from flawed bucket-to-region lock mapping in the kernel's ipset subsystem, which allows an asynchronous race between element eviction and concurrent insertions. Successful exploitation is limited to a local denial of service through system instability or deadlock, with no direct risk to host confidentiality or integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.