Linux Kernel Netfilter Vulnerability in Bridge Handling

CVE-2025-39894

What is CVE-2025-39894?

A vulnerability has been identified in the Linux kernel's netfilter related to bridge handling that can lead to warnings during network packet transmission. Specifically, when broadcast packets are sent to a tap device within a bridge, unexpected behavior may occur if another conntrack is added with the same hash. This situation can trigger warnings due to conflicts in the conntrack hash table management. The ineffective handling of confirmed conntracks can result in unnecessary warnings during the processing of network packets, affecting system stability and performance.

References