CVE-2025-39851

What it actually does

NULL pointer dereference in vxlan_snoop when a packet attempts to refresh an FDB entry that uses an FDB nexthop group instead of a remote destination, occurring because the drop check happens after dereferencing the non-existent remote pointer.

Why it matters to the business

Systems running affected Linux kernels with VXLAN learning enabled and EVPN-style FDB nexthop groups can experience kernel crashes leading to denial of service and potential service disruption in network virtualization environments.

How an attack unfolds

An attacker with the ability to send packets into a VXLAN interface configured with learning enabled and an FDB entry pointing to a nexthop group sends a packet matching the FDB entry, triggering the dereference path in vxlan_snoop and causing a kernel NULL pointer dereference crash.

How to fix it

Upgrade the Linux kernel to a version containing commit 4ff4f3104da6507e0f118c63c4560dfdeb59dce3 or later stable releases; for puppet on Debian 11 apply version 3.7.0-1 or newer. Disable learning on affected VXLAN interfaces as a temporary mitigation if patching is delayed.

How to confirm the fix worked

Verify the running kernel contains the fix commit or is newer than the vulnerable versions listed; attempt reproduction of the provided mausezahn-based test case in a lab environment and confirm no crash occurs; check kernel logs for absence of vxlan_snoop NULL dereference oops.

Typical attack path

1. Set up VXLAN interfaces with learning enabled and FDB entries using nexthop groups
2. Send crafted Ethernet frames matching the FDB entry from a local or adjacent context
3. Trigger vxlan_snoop path that dereferences non-existent remote before dropping the packet
4. Cause kernel panic via NULL pointer dereference

How to detect it

Inspect kernel logs for BUG: kernel NULL pointer dereference with call traces containing vxlan_snoop, vxlan_encap_bypass, and vxlan_xmit_one; correlate with mausezahn or similar packet generation tools and VXLAN interface activity.

What your security team should do

• Prioritize kernel updates on all systems using VXLAN with learning enabled
• Review VXLAN configurations for use of FDB nexthop groups combined with learning
• Apply the specific fixed versions for puppet (Debian:11) 3.7.0-1 and git commit 4ff4f3104da6507e0f118c63c4560dfdeb59dce3
• Monitor EPSS trend and reassess exploit maturity as it has increased 35% over 30 days