CVE-2025-39850

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects

When the "proxy" option is enabled on a VXLAN device, the device will

suppress ARP requests and IPv6 Neighbor Solicitation messages if it is

able to reply on behalf of the remote host. That is, if a matching and

valid neighbor entry is configured on the VXLAN device whose MAC address

is not behind the "any" remote (0.0.0.0 / ::).

The code currently assumes that the FDB entry for the neighbor's MAC

address points to a valid remote destination, but this is incorrect if

the entry is associated with an FDB nexthop group. This can result in a

NPD [1][3] which can be reproduced using [2][4].

Fix by checking that the remote destination exists before dereferencing

it.

[1]

BUG: kernel NULL pointer dereference, address: 0000000000000000

[...]

CPU: 4 UID: 0 PID: 365 Comm: arping Not tainted 6.17.0-rc2-virtme-g2a89cb21162c #2 PREEMPT(voluntary)

Hardware name: Q

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References