Null Pointer Dereference Vulnerability in Linux Kernel's VXLAN Implementation

CVE-2025-39851

What is CVE-2025-39851?

A vulnerability in the Linux kernel’s VXLAN implementation can lead to a null pointer dereference when handling FDB entries. In scenarios where learning is enabled, incoming packets that attempt to refresh FDB entries pointing to a nexthop group may not be properly dropped. This oversight occurs because the drop action is executed only after dereferencing a non-existent remote, which can result in a system crash. The issue has been fixed by ensuring packets are dropped at an earlier stage, thereby mitigating the risk of such dereferencing in future packet processing.

References