CVE-2025-39894

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc2-dirty #44

Description The Linux kernel contains an issue within the netfilter module, specifically in the br netfilter component. A hash collision can occur when handling broadcast packets sent to a bridge interface, potentially leading to a warning message. This happens because br nf local in() continues to use an outdated conntrack entry after a confirmation process, even if the confirmation fails to insert a new entry. The issue arises when another conntrack with the same hash value is added to the hash table, triggered by a normal packet to a non-bridge device. The function br nf local in() is involved in the process, and the warning message indicates a potential problem with conntrack management.

Recommendations Update to a version beyond 6.17.0-rc2-dirty #44.