ZeroDay Findings
Sign inSign up

Findings

CVE-2025-39850

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects When the "proxy" option is enabled on a VXLAN

Published Sep 19, 2025 · updated Oct 14, 2026

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of the remote host. That is, if a matching and valid neighbor entry is configured on the VXLAN device whose MAC address is not behind the "any" remote (0.0.0.0 / ::). The code currently assumes that the FDB entry for the neighbor's MAC address points to a valid remote destination, but this is incorrect if the entry is associated with an FDB nexthop group. This can result in a NPD [1][3] which can be reproduced using [2][4]. Fix by checking that the remote destination exists before dereferencing it. [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 4 UID: 0 PID: 365 Comm: arping Not tainted 6.17.0-rc2-virtme-g2a89cb21162c #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlan_xmit+0xb58/0x15f0 [...] Call Trace: dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] #!/bin/bash ip address add 192.0.2.1/32 dev lo ip nexthop add id 1 via 192.0.2.2 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 4789 proxy ip neigh add 192.0.2.3 lladdr 00:11:22:33:44:55 nud perm dev vx0 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10 arping -b -c 1 -s 192.0.2.1 -I vx0 192.0.2.3 [3] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID: 0 PID: 372 Comm: ndisc6 Not tainted 6.17.0-rc2-virtmne-g6ee90cb26014 #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1v996), BIOS 1.17.0-4.fc41 04/01/2x014 RIP: 0010:vxlan

Timeline

Detection, updates, and resolution for this record.

  1. Sep 19, 2025 · OSV.dev

    Detected

    In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of the remote host. That is, if a matching and valid neighbor entry is configured on the VXLAN device

  2. Oct 14, 2026 · OSV.dev

    Fix available

    linux-aws-6.8 fixed in 6.8.0-1050.53~22.04.1; linux-azure-6.8 fixed in 6.8.0-1051.57~22.04.1; linux-azure-fde-6.8 fixed in 6.8.0-1058.65~22.04.1; linux-gcp-6.8 fixed in 6.8.0-1052.55~22.04.1

  3. Oct 14, 2026 · OSV.dev

    Updated

    In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of the remote host. That is, if a matching and valid neighbor entry is configured on the VXLAN device

Affected

  • Ubuntu:16.04:LTS linux-hwe-edge4.8.0-28.30~16.04.1, 4.8.0-30.32~16.04.1, 4.8.0-32.34~16.04.1
  • Ubuntu:18.04:LTS linux-aws-5.05.0.0-1021.24~18.04.1, 5.0.0-1022.25~18.04.1, 5.0.0-1023.26~18.04.1
  • Ubuntu:18.04:LTS linux-aws-5.35.3.0-1016.17~18.04.1, 5.3.0-1017.18~18.04.1, 5.3.0-1019.21~18.04.1
  • Ubuntu:18.04:LTS linux-azure4.15.0-1002.2, 4.15.0-1003.3, 4.15.0-1004.4
  • Ubuntu:18.04:LTS linux-azure-5.35.3.0-1007.8~18.04.1, 5.3.0-1008.9~18.04.1, 5.3.0-1009.10~18.04.1
  • Ubuntu:18.04:LTS linux-azure-edge4.18.0-1006.6~18.04.1, 4.18.0-1007.7~18.04.1, 4.18.0-1008.8~18.04.1
  • Ubuntu:18.04:LTS linux-gcp4.15.0-1001.1, 4.15.0-1003.3, 4.15.0-1005.5
  • Ubuntu:18.04:LTS linux-gcp-5.35.3.0-1008.9~18.04.1, 5.3.0-1009.10~18.04.1, 5.3.0-1010.11~18.04.1
  • Ubuntu:18.04:LTS linux-gke-4.154.15.0-1030.32, 4.15.0-1032.34, 4.15.0-1033.35
  • Ubuntu:18.04:LTS linux-gke-5.45.4.0-1025.25~18.04.1, 5.4.0-1027.28~18.04.1, 5.4.0-1029.31~18.04.1
  • Ubuntu:18.04:LTS linux-gkeop-5.45.4.0-1001.1, 5.4.0-1003.3, 5.4.0-1004.5
  • Ubuntu:18.04:LTS linux-hwe4.18.0-13.14~18.04.1, 4.18.0-14.15~18.04.1, 4.18.0-15.16~18.04.1

Sources

References

CVE-2025-39850 · ZeroDay Findings