CVE-2025-39980— nexthop: Forbid FDB status change while nexthop is in a group
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-39980
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
nexthop: Forbid FDB status change while nexthop is in a group
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nexthop: Forbid FDB status change while nexthop is in a group The kernel forbids the creation of non-FDB nexthop groups with FDB nexthops: # ip nexthop add id 1 via 192.0.2.1 fdb # ip nexthop add id 2 group 1 Error: Non FDB nexthop group cannot have fdb nexthops. And vice versa: # ip nexthop add id 3 via 192.0.2.2 dev dummy1 # ip nexthop add id 4 group 3 fdb Error: FDB nexthop group can only have fdb nexthops. However, as long as no routes are pointing to a non-FDB nexthop group, the kernel allows changing the type of a nexthop from FDB to non-FDB and vice versa: # ip nexthop add id 5 via 192.0.2.2 dev dummy1 # ip nexthop add id 6 group 5 # ip nexthop replace id 5 via 192.0.2.2 fdb # echo $? 0 This configuration is invalid and can result in a NPD [1] since FDB nexthops are not associated with a nexthop device: # ip route add 198.51.100.1/32 nhid 6 # ping 198.51.100.1 Fix by preventing nexthop FDB status change while the nexthop is in a group: # ip nexthop add id 7 via 192.0.2.2 dev dummy1 # ip nexthop add id 8 group 7 # ip nexthop replace id 7 via 192.0.2.2 fdb Error: Cannot change nexthop FDB status while in a group. [1] BUG: kernel NULL pointer dereference, address: 00000000000003c0 [...] Oops: Oops: 0000 [#1] SMP CPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:fib_lookup_good_nhc+0x1e/0x80 [...] Call Trace: <TASK> fib_table_lookup+0x541/0x650 ip_route_output_key_hash_rcu+0x2ea/0x970 ip_route_output_key_hash+0x55/0x80 __ip4_datagram_connect+0x250/0x330 udp_connect+0x2b/0x60 __sys_connect+0x9c/0xd0 __x64_sys_connect+0x18/0x20 do_syscall_64+0xa4/0x2a0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于允许在nexthop处于组中时更改FDB状态，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-39980
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-39980
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-10-15 · 34 CVEs total
| CVE-2025-39973 | i40e: add validation for ring_len param | |
| CVE-2025-39982 | Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync | |
| CVE-2025-39981 | Bluetooth: MGMT: Fix possible UAFs | |
| CVE-2025-39979 | net/mlx5: fs, fix UAF in flow counter release | |
| CVE-2025-39978 | octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() | |
| CVE-2025-39977 | futex: Prevent use-after-free during requeue-PI | |
| CVE-2025-39976 | futex: Use correct exit on failure from futex_hash_allocate_default() | |
| CVE-2025-39975 | smb: client: fix wrong index reference in smb2_compound_op() | |
| CVE-2025-39974 | tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit() | |
| CVE-2025-39984 | net: tun: Update napi->skb after XDP process | |
| CVE-2025-39972 | i40e: fix idx validation in i40e_validate_queue_map | |
| CVE-2025-39970 | i40e: fix input validation logic for action_meta | |
| CVE-2025-39971 | i40e: fix idx validation in config queues msg | |
| CVE-2025-39969 | i40e: fix validation of VF state in get resources | |
| CVE-2025-39968 | i40e: add max boundary check for VF filters | |
| CVE-2025-39967 | fbcon: fix integer overflow in fbcon_do_set_font | |
| CVE-2025-39966 | iommufd: Fix race during abort for file descriptors | |
| CVE-2025-40000 | wifi: rtw89: fix use-after-free in rtw89_core_tx_kick_off_and_wait() | |
| CVE-2025-39983 | Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue | |
| CVE-2025-39985 | can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2025-39980
No comments yet