CVE-2025-37998 openvswitch: Fix unsafe attribute parsing in output_userspace()

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified in Open vSwitch Vulnerabilities Two critical vulnerabilities in Open vSwitch have been reported, CVE-2025-37998 and CVE-2025-21761. CVE-2025-37998, published on May 29, 2025, addresses unsafe attribute parsing in the output_userspace() function, while CVE-2025-21761, published on February 27, 2025, involves the use of RCU protection in the ovs_vport_cmd_fill_info() function. Both vulnerabilities could potentially affect users of Open vSwitch. 4 sources 41