CVE-2025-39851

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vxlan: Fix NPD when refreshing an FDB entry with a nexthop object

VXLAN FDB entries can point to either a remote destination or an FDB

nexthop group. The latter is usually used in EVPN deployments where

learning is disabled.

However, when learning is enabled, an incoming packet might try to

refresh an FDB entry that points to an FDB nexthop group and therefore

does not have a remote. Such packets should be dropped, but they are

only dropped after dereferencing the non-existent remote, resulting in a

NPD [1] which can be reproduced using [2].

Fix by dropping such packets earlier. Remove the misleading comment from

first_remote_rcu().

[1]

BUG: kernel NULL pointer dereference, address: 0000000000000000

[...]

CPU: 13 UID: 0 PID: 361 Comm: mausezahn Not tainted 6.17.0-rc1-virtme-g9f6b606b6b37 #1 PREEMPT(voluntary)

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014

RIP: 0010:vxlan_snoop

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References