CVE-2025-39851

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: Fix NPD when refreshing an FDB entry with a nexthop object

VXLAN FDB entries can point to either a remote destination or an FDB

nexthop group. The latter is usually used in EVPN deployments where

learning is disabled.

However, when learning is enabled, an incoming packet might try to

refresh an FDB entry that points to an FDB nexthop group and therefore

does not have a remote. Such packets should be dropped, but they are

only dropped after dereferencing the non-existent remote, resulting in a

NPD [1] which can be reproduced using [2].

Fix by dropping such packets earlier. Remove the misleading comment from

first_remote_rcu().

[1]

BUG: kernel NULL pointer dereference, address: 0000000000000000

[...]

CPU: 13 UID: 0 PID: 361 Comm: mausezahn Not tainted 6.17.0-rc1-virtme-g9f6b606b6b37 #1 PREEMPT(voluntary)

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014

RIP: 0010:vxlan_snoop

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References