CVE-2025-39850
- Source
- https://cve.org/CVERecord?id=CVE-2025-39850
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39850.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-39850
- Downstream
- Related
- Published
- 2025-09-19T15:26:22.803Z
- Modified
- 2026-03-23T05:05:43.670080628Z
- Severity
-
- 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of the remote host. That is, if a matching and valid neighbor entry is configured on the VXLAN device whose MAC address is not behind the "any" remote (0.0.0.0 / ::).
The code currently assumes that the FDB entry for the neighbor's MAC address points to a valid remote destination, but this is incorrect if the entry is associated with an FDB nexthop group. This can result in a NPD [1][3] which can be reproduced using [2][4].
Fix by checking that the remote destination exists before dereferencing it.
[1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 4 UID: 0 PID: 365 Comm: arping Not tainted 6.17.0-rc2-virtme-g2a89cb21162c #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlanxmit+0xb58/0x15f0 [...] Call Trace: <TASK> devhardstartxmit+0x5d/0x1c0 __devqueuexmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64syssendto+0x24/0x30 dosyscall64+0xa4/0x260 entrySYSCALL64afterhwframe+0x4b/0x53
[2] #!/bin/bash
ip address add 192.0.2.1/32 dev lo
ip nexthop add id 1 via 192.0.2.2 fdb ip nexthop add id 10 group 1 fdb
ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 4789 proxy
ip neigh add 192.0.2.3 lladdr 00:11:22:33:44:55 nud perm dev vx0
bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10
arping -b -c 1 -s 192.0.2.1 -I vx0 192.0.2.3
[3] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID: 0 PID: 372 Comm: ndisc6 Not tainted 6.17.0-rc2-virtmne-g6ee90cb26014 #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1v996), BIOS 1.17.0-4.fc41 04/01/2x014 RIP: 0010:vxlanxmit+0x803/0x1600 [...] Call Trace: <TASK> devhardstartxmit+0x5d/0x1c0 __devqueuexmit+0x246/0xfd0 ip6_finishoutput2+0x210/0x6c0 ip6finishoutput+0x1af/0x2b0 ip6mroutput+0x92/0x3e0 ip6sendskb+0x30/0x90 rawv6sendmsg+0xe6e/0x12e0 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64syssendto+0x24/0x30 dosyscall64+0xa4/0x260 entrySYSCALL64afterhwframe+0x4b/0x53 RIP: 0033:0x7f383422ec77
[4] #!/bin/bash
ip address add 2001:db8:1::1/128 dev lo
ip nexthop add id 1 via 2001:db8:1::1 fdb ip nexthop add id 10 group 1 fdb
ip link add name vx0 up type vxlan id 10010 local 2001:db8:1::1 dstport 4789 proxy
ip neigh add 2001:db8:1::3 lladdr 00:11:22:33:44:55 nud perm dev vx0
bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10
ndisc6 -r 1 -s 2001:db8:1::1 -w 1 2001:db8:1::3 vx0
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39850.json" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/1f5d2fd1ca04a23c18b1bde9a43ce2fa2ffa1bce
- https://git.kernel.org/stable/c/8cfa0f076842f9b3b4eb52ae0e41d16e25cbf8fa
- https://git.kernel.org/stable/c/e211e3f4199ac829bd493632efcd131d337cba9d
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39850.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-39850
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1274e1cc42264d4e629841e4f182795cb0becfd2Fixede211e3f4199ac829bd493632efcd131d337cba9dFixed8cfa0f076842f9b3b4eb52ae0e41d16e25cbf8faFixed1f5d2fd1ca04a23c18b1bde9a43ce2fa2ffa1bce
Affected versions
v5.*
v6.*
Database specific
vanir_signatures
[
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"84868179412285924494429763478486643278",
"324115356235956910570426103851782206780",
"125140396808532237244971368228062035037",
"252753435006826951136045394807255389724",
"262954016167615838286717632587660708028",
"324244718752065340730100805447589839126",
"266833984805723495895083537588674375091",
"16532301370448114697957688299752502913",
"265911611681186161104456772361287321940",
"186926518678274388709105290091014721432",
"239409930636549139904425176343307267789",
"252753435006826951136045394807255389724",
"338773858518029831645119681075485389243",
"63438957512602201167963882646653457519",
"211028345007755396760945968117269040370",
"128310782588611963555453730566996577902"
]
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-39850-79c5f82e",
"target": {
"file": "drivers/net/vxlan/vxlan_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f5d2fd1ca04a23c18b1bde9a43ce2fa2ffa1bce"
},
{
"digest": {
"length": 1916.0,
"function_hash": "170064371191970466509218471198252778594"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-39850-af03c0aa",
"target": {
"function": "arp_reduce",
"file": "drivers/net/vxlan/vxlan_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f5d2fd1ca04a23c18b1bde9a43ce2fa2ffa1bce"
},
{
"digest": {
"length": 1239.0,
"function_hash": "168200305107438317507330632725837273519"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-39850-f0976962",
"target": {
"function": "neigh_reduce",
"file": "drivers/net/vxlan/vxlan_core.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f5d2fd1ca04a23c18b1bde9a43ce2fa2ffa1bce"
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39850.json"