Race Condition in Linux Kernel's Netfilter: ipset Affected by Region Locking Issue

CVE-2025-37997

What is CVE-2025-37997?

A vulnerability in the Linux Kernel's Netfilter ipset component was identified, stemming from improper region locking mechanisms introduced in version v5.6-rc4. The macros utilized for handling region locks, namely ahash_bucket_start() and ahash_bucket_end(), were intended to manage hash bucket values, while ahash_region() was supposed to correctly return the region lock for a given hash bucket. However, a flaw in the latter can trigger race conditions between the garbage collector and new element insertion in a hash set defined with timeouts, potentially compromising system stability and security.

References