CVE-2025-39894

What it actually does

The flaw skips the confirmed bit check in br_nf_local_in() after packet confirmation, allowing improperly validated bridged packets to proceed through netfilter.

Why it matters to the business

Increases exposure of network filtering controls to bypass in virtual or containerized environments, potentially allowing unauthorized traffic flows until patched.

How an attack unfolds

An attacker sends crafted packets targeting bridged interfaces; because the confirmed bit is not re-checked after confirmation, malicious packets evade intended netfilter rules and reach their destination.

How to fix it

Upgrade openssh/openssh-portable to the fixed commit 9f82e5a9042f2d872e98f48a876fcab3e25dd9bb; apply kernel patches addressing br_netfilter confirmed-bit handling; test bridged traffic policies after update.

How to confirm the fix worked

Confirm the updated commit is present in the running kernel or package; replay test packets that previously bypassed rules and verify they are now dropped or logged as expected.

Typical attack path

1. Map target systems using br_netfilter in bridged setups
2. Craft packets that trigger the post-confirmation path in br_nf_local_in()
3. Transmit packets to bypass firewall or NAT rules
4. Establish unauthorized connectivity or deliver payloads

How to detect it

Review netfilter and bridge logs for packets that reach local input after confirmation without expected state transitions; look for unusual bridged traffic patterns in system and audit logs.

What your security team should do

• Prioritize patching systems with active br_netfilter bridged configurations
• Review and tighten netfilter rules on bridged interfaces
• Monitor EPSS trend for any future increase