CVE-2025-39980

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.17.0-rc6-virtme-gb65678cacc03

Description The Linux kernel contains a flaw related to nexthop handling. Specifically, the kernel previously allowed changes to a nexthop’s FDB status while it was part of a group, which could lead to a NULL pointer dereference and a kernel oops. This occurred because the kernel permitted altering the type of a nexthop from FDB to non-FDB and vice versa, even when routes pointed to a non-FDB nexthop group. The fix prevents nexthop FDB status changes when the nexthop is within a group. An incident involving a kernel NULL pointer dereference was observed, potentially triggered by this condition. The fib lookup good nhc function is involved in the issue.

Recommendations Update to a version later than 6.17.0-rc6-virtme-gb65678cacc03.