CVE-2025-39851

一、漏洞信息
 漏洞编号：[CVE-2025-39851](https://nvd.nist.gov/vuln/detail/CVE-2025-39851)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0,6.1.19,6.4.0,6.6.0
 CVSS V4.0分值：
  BaseScore：N/A None
  Vector：
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:vxlan: Fix NPD when refreshing an FDB entry with a nexthop objectVXLAN FDB entries can point to either a remote destination or an FDBnexthop group. The latter is usually used in EVPN deployments wherelearning is disabled.However, when learning is enabled, an incoming packet might try torefresh an FDB entry that points to an FDB nexthop group and thereforedoes not have a remote. Such packets should be dropped, but they areonly dropped after dereferencing the non-existent remote, resulting in aNPD [1] which can be reproduced using [2].Fix by dropping such packets earlier. Remove the misleading comment fromfirst_remote_rcu().[1]BUG: kernel NULL pointer dereference, address: 0000000000000000[...]CPU: 13 UID: 0 PID: 361 Comm: mausezahn Not tainted 6.17.0-rc1-virtme-g9f6b606b6b37 #1 PREEMPT(voluntary)Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014RIP: 0010:vxlan_snoop+0x98/0x1e0[...]Call Trace: <TASK> vxlan_encap_bypass+0x209/0x240 encap_bypass_if_local+0xb1/0x100 vxlan_xmit_one+0x1375/0x17e0 vxlan_xmit+0x6b4/0x15f0 dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53[2] #!/bin/bash ip address add 192.0.2.1/32 dev lo ip address add 192.0.2.2/32 dev lo ip nexthop add id 1 via 192.0.2.3 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 12345 localbypass ip link add name vx1 up type vxlan id 10020 local 192.0.2.2 dstport 54321 learning bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 192.0.2.2 port 54321 vni 10020 bridge fdb add 00:aa:bb:cc:dd:ee dev vx1 self static nhid 10 mausezahn vx0 -a 00:aa:bb:cc:dd:ee -b 00:11:22:33:44:55 -c 1 -q
 漏洞公开时间：2025-09-20 00:15:43
 漏洞创建时间：2025-09-19 23:54:44
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2025-39851
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://ubuntu.com/security/CVE-2025-39851 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38201 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38350 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38319 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22020 |  |
|  | https://docs.bell-sw.com/security/cves/CVE-2025-39851 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-56591 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2800 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39853 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39953 |  |
|  | https://linux.oracle.com/cve/CVE-2025-39851.html |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38664 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37749 |  |
|  | https://git.kernel.org/stable/c/0e8630f24c14d9c655d19eabe2e52a9e9f713307 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2465 |  |
|  | https://git.kernel.org/linus/6ead38147ebb813f08be6ea8ef547a0e4c09559a |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38729 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37741 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2025-39851 |  |
|  | https://advisory.echohq.com/cve/CVE-2025-39851 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-21905 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22005 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38086 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40139 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39752 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-57911 |  |
|  | https://security-tracker.debian.org/tracker/CVE-2025-39851 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39895 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-38662 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2801 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2023-53282 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22083 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22039 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2023-53192 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-58034 |  |
|  | https://git.kernel.org/stable/c/4ff4f3104da6507e0f118c63c4560dfdeb59dce3 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2023-53520 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37927 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-57907 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39883 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37785 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39760 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2023-53673 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39739 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38706 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-37789 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39683 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22081 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39819 |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2396916 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39715 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39844 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2466 |  |
|  | https://linux.oracle.com/errata/ELSA-2025-25754.html |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39850 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025091904-CVE-2025-39851-8a50@gregkh/T |  |
|  | https://git.kernel.org/stable/c/6ead38147ebb813f08be6ea8ef547a0e4c09559a |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38285 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39851 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39845 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38527 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39914 |  |
|  | https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2467 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39865 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-23150 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39886 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-42102 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025091904-CVE-2025-39851-8a50@gregkh/T/#u |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2023-53491 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-23158 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-40102 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2024-49875 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2023-53091 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-39824 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-38617 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2025-22022 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://git.kernel.org/stable/c/4ff4f3104da6507e0f118c63c4560dfdeb59dce3 |  | ljqc |
| gregkh/linux |  | https://git.kernel.org/stable/c/0e8630f24c14d9c655d19eabe2e52a9e9f713307 |  | ljqc |
|  |  | https://git.kernel.org/stable/c/0e8630f24c14d9c655d19eabe2e52a9e9f713307 |  | cvelistv5 |
|  |  | https://git.kernel.org/linus/6ead38147ebb813f08be6ea8ef547a0e4c09559a |  | osv |
|  |  | https://git.kernel.org/stable/c/4ff4f3104da6507e0f118c63c4560dfdeb59dce3 |  | cvelistv5 |
|  |  | https://git.kernel.org/stable/c/6ead38147ebb813f08be6ea8ef547a0e4c09559a |  | cvelistv5 |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
    In the Linux kernel, the following vulnerability has been resolved:vxlan: Fix NPD when refreshing an FDB entry with a nexthop objectVXLAN FDB entries can point to either a remote destination or an FDBnexthop group. The latter is usually used in EVPN deployments wherelearning is disabled.However, when learning is enabled, an incoming packet might try torefresh an FDB entry that points to an FDB nexthop group and thereforedoes not have a remote. Such packets should be dropped, but they areonly dropped after dereferencing the non-existent remote, resulting in aNPD [1] which can be reproduced using [2].Fix by dropping such packets earlier. Remove the misleading comment fromfirst_remote_rcu().[1]BUG: kernel NULL pointer dereference, address: 0000000000000000[...]CPU: 13 UID: 0 PID: 361 Comm: mausezahn Not tainted 6.17.0-rc1-virtme-g9f6b606b6b37 #1 PREEMPT(voluntary)Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014RIP: 0010:vxlan_snoop+0x98/0x1e0[...]Call Trace: &lt;TASK&gt; vxlan_encap_bypass+0x209/0x240 encap_bypass_if_local+0xb1/0x100 vxlan_xmit_one+0x1375/0x17e0 vxlan_xmit+0x6b4/0x15f0 dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53[2] #!/bin/bash ip address add 192.0.2.1/32 dev lo ip address add 192.0.2.2/32 dev lo ip nexthop add id 1 via 192.0.2.3 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 12345 localbypass ip link add name vx1 up type vxlan id 10020 local 192.0.2.2 dstport 54321 learning bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 192.0.2.2 port 54321 vni 10020 bridge fdb add 00:aa:bb:cc:dd:ee dev vx1 self static nhid 10 mausezahn vx0 -a 00:aa:bb:cc:dd:ee -b 00:11:22:33:44:55 -c 1 -qThe Linux kernel CVE team has assigned CVE-2025-39851 to this issue. 
 openEuler评分：
  5.7
 Vector：CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-22.03-LTS-SP3(5.10.0):受影响
2.openEuler-22.03-LTS-SP4(5.10.0):受影响
3.openEuler-24.03-LTS(6.6.0):受影响
4.openEuler-24.03-LTS-SP1(6.6.0):受影响
5.openEuler-24.03-LTS-SP2(6.6.0):受影响
6.master(6.12.33):不受影响
7.openEuler-20.03-LTS-SP4(4.19.90):不受影响
8.openEuler-24.03-LTS-Next(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-24.03-LTS(6.6.0):正常修复
2.openEuler-24.03-LTS-SP1(6.6.0):正常修复
3.openEuler-24.03-LTS-SP2(6.6.0):正常修复
4.openEuler-22.03-LTS-SP3(5.10.0):不修复-超出修复范围
5.openEuler-22.03-LTS-SP4(5.10.0):不修复-超出修复范围
6.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
8.openEuler-20.03-LTS-SP4(4.19.90):不受影响-漏洞代码不存在

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2025-2801

src-openEuler/kernel
Closed

Content Risk Flag

Comments (8)

src-openEuler/kernelClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2025-39851

Comments (8)

Search

src-openEuler/kernel
Closed