CVE-2025-39980

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nexthop: Forbid FDB status change while nexthop is in a group

The kernel forbids the creation of non-FDB nexthop groups with FDB

nexthops:

# ip nexthop add id 1 via 192.0.2.1 fdb

# ip nexthop add id 2 group 1

Error: Non FDB nexthop group cannot have fdb nexthops.

And vice versa:

# ip nexthop add id 3 via 192.0.2.2 dev dummy1

# ip nexthop add id 4 group 3 fdb

Error: FDB nexthop group can only have fdb nexthops.

However, as long as no routes are pointing to a non-FDB nexthop group,

the kernel allows changing the type of a nexthop from FDB to non-FDB and

vice versa:

# ip nexthop add id 5 via 192.0.2.2 dev dummy1

# ip nexthop add id 6 group 5

# ip nexthop replace id 5 via 192.0.2.2 fdb

# echo $?

0

This configuration is invalid and can result in a NPD [1] since FDB

nexthops are not associated with a nexthop device:

# ip route add 198.51.100.1/32 nhid 6

# ping 198.51.100.1

Fix by preventing nexthop FDB

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References