CVE-2025-39980

What it actually does

Allows modification of a nexthop's FDB flag while the nexthop remains a member of an existing group, producing an inconsistent internal state in which FDB nexthops lack an associated device; subsequent route lookups dereference a NULL pointer in fib_lookup_good_nhc.

Why it matters to the business

Kernel crashes and denial of service on systems that perform nexthop configuration changes under load or that later exercise routes using the affected groups; requires local administrative privileges.

How an attack unfolds

An attacker with CAP_NET_ADMIN creates a non-FDB nexthop, adds it to a group, then replaces the nexthop with the FDB flag set; any subsequent route lookup or connect operation through that group triggers the NULL dereference and kernel oops.

How to fix it

Upgrade the Linux kernel to a version containing commit e1e87ac0daacd51f522ecd1645cd76b5809303ed or later; apply the equivalent stable-branch patch if running a distribution kernel.

How to confirm the fix worked

Verify the kernel contains the fix commit; confirm that the ip nexthop replace command now returns "Error: Cannot change nexthop FDB status while in a group" instead of succeeding; run regression tests that exercise grouped FDB nexthops.

Typical attack path

1. Obtain CAP_NET_ADMIN on the target host
2. Create a non-FDB nexthop and place it inside a nexthop group
3. Replace the nexthop, setting the FDB flag while it remains grouped
4. Add or use a route that references the group
5. Trigger packet processing or a connect syscall to cause lookup

How to detect it

Search kernel logs and dmesg for Oops messages referencing fib_lookup_good_nhc, NULL pointer dereference at address 00000000000003c0, and call traces containing fib_table_lookup or ip_route_output_key_hash; correlate with preceding ip nexthop replace operations that alter FDB status on grouped objects.

• BUG: kernel NULL pointer dereference, address: 00000000000003c0
• RIP: 0010:fib_lookup_good_nhc+0x1e/0x80
• fib_table_lookup+0x541/0x650
• Error: Cannot change nexthop FDB status while in a group

What your security team should do

• Patch kernels to the fixed commit on all affected hosts within the next maintenance window
• Audit scripts and automation that manipulate nexthop objects for FDB/group combinations
• Monitor for kernel oops containing fib_lookup_good_nhc after any nexthop configuration change
• Restrict CAP_NET_ADMIN to trusted processes only