CVE-2025-39894

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm

When send a broadcast packet to a tap device, which was added to a bridge,

br_nf_local_in() is called to confirm the conntrack. If another conntrack

with the same hash value is added to the hash table, which can be

triggered by a normal packet to a non-bridge device, the below warning

may happen.

------------[ cut here ]------------

WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200

CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)

RIP: 0010:br_nf_local_in+0x168/0x200

Call Trace:

<TASK>

nf_hook_slow+0x3e/0xf0

br_pass_frame_up+0x103/0x180

br_handle_frame_finish+0x2de/0x5b0

br_nf_hook_thresh+0xc0/0x120

br_nf_pre_routing_finish+0x168/0x3a0

br_nf_pre_routing+0x237/0x5e0

br_handle_frame+0x1ec/0x3c0

__netif_receive_skb_core+

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References