CVE-2025-37921: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-37921 is a vulnerability discovered in the Linux kernel's VXLAN implementation, specifically affecting the vnifilter mode functionality. The vulnerability was disclosed on May 20, 2025, and involves improper synchronization when deleting a VNI (Virtual Network Identifier) from a VXLAN device (NVD, Wiz).

The vulnerability occurs when a VNI is deleted from a VXLAN device in 'vnifilter' mode, where the FDB (Forwarding Database) entry associated with the default remote is deleted without holding the hash lock. This synchronization issue was exposed by a lockdep annotation added by commit ebe642067455. The issue can be reproduced through specific network configuration commands involving VXLAN device setup and VNI manipulation (NVD, Wiz).

When triggered, the vulnerability results in a warning being generated by the lockdep annotation system, indicating a potential race condition in the kernel's VXLAN subsystem. This could lead to memory corruption or system instability in the networking stack (Wiz).

The vulnerability has been fixed in the Linux kernel by implementing a patch that acquires the hash lock before the deletion operation and releases it afterwards. For the Debian stable distribution (bookworm), these problems have been fixed in version 6.1.140-1 (Debian, Wiz).