CVE-2025-37959

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Scrub packet on bpf_redirect_peer

When bpf_redirect_peer is used to redirect packets to a device in

another network namespace, the skb isn't scrubbed. That can lead skb

information from one namespace to be "misused" in another namespace.

As one example, this is causing Cilium to drop traffic when using

bpf_redirect_peer to redirect packets that just went through IPsec

decryption to a container namespace. The following pwru trace shows (1)

the packet path from the host's XFRM layer to the container's XFRM

layer where it's dropped and (2) the number of active skb extensions at

each function.

NETNS MARK IFACE TUPLE FUNC

4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 xfrm_rcv_cb

.active_extensions = (__u8)2,

4026533547 d00 eth0 10.244.3.124:35473->10.244.2.158:53 xfrm4_rcv_cb

.active_ex

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References