PT-2025-42255 · Linux+3 · Linux Kernel+3
Published
2025-09-23
·
Updated
2026-05-22
·
CVE-2025-39980
CVSS v2.0
6.0
Medium
| Vector | AV:L/AC:H/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.17.0-rc6-virtme-gb65678cacc03
Description
The Linux kernel contains a flaw related to nexthop handling. Specifically, the kernel previously allowed changes to a nexthop’s FDB status while it was part of a group, which could lead to a NULL pointer dereference and a kernel oops. This occurred because the kernel permitted altering the type of a nexthop from FDB to non-FDB and vice versa, even when routes pointed to a non-FDB nexthop group. The fix prevents nexthop FDB status changes when the nexthop is within a group. An incident involving a kernel NULL pointer dereference was observed, potentially triggered by this condition. The
fib lookup good nhc function is involved in the issue.Recommendations
Update to a version later than 6.17.0-rc6-virtme-gb65678cacc03.
Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Ubuntu