---
id: CVE-2025-39850
title: 'vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects

  When the "proxy" option is enabled on a VXLAN device, the device will
  suppress ARP requests and IPv6 …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: adp
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1274e1cc42264d4e629841e4f182795cb0becfd2 <
    87cd41faceb0eea6201d32d6b11f861ea30591ae
  - >-
    Linux >= 1274e1cc42264d4e629841e4f182795cb0becfd2 <
    8ba034c41b20dc4f32ece748f1429709ae8ceedc
  - >-
    Linux >= 1274e1cc42264d4e629841e4f182795cb0becfd2 <
    e211e3f4199ac829bd493632efcd131d337cba9d
  - >-
    Linux >= 1274e1cc42264d4e629841e4f182795cb0becfd2 <
    8cfa0f076842f9b3b4eb52ae0e41d16e25cbf8fa
  - >-
    Linux >= 1274e1cc42264d4e629841e4f182795cb0becfd2 <
    1f5d2fd1ca04a23c18b1bde9a43ce2fa2ffa1bce
  - Linux 5.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-01-14T19:20:51.126279Z'
published: '2025-09-19'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:22:32.080Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-39850'
references:
  - url: 'https://git.kernel.org/stable/c/87cd41faceb0eea6201d32d6b11f861ea30591ae'
  - url: 'https://git.kernel.org/stable/c/8ba034c41b20dc4f32ece748f1429709ae8ceedc'
  - url: 'https://git.kernel.org/stable/c/e211e3f4199ac829bd493632efcd131d337cba9d'
  - url: 'https://git.kernel.org/stable/c/8cfa0f076842f9b3b4eb52ae0e41d16e25cbf8fa'
  - url: 'https://git.kernel.org/stable/c/1f5d2fd1ca04a23c18b1bde9a43ce2fa2ffa1bce'
tags:
  - cve.org
epss: 0.00197
epssPercentile: 0.09526
ingestedAt: '2026-10-21T12:48:53.688Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects

When the "proxy" option is enabled on a VXLAN device, the device will
suppress ARP requests and IPv6 Neighbor Solicitation messages if it is
able to reply on behalf of the remote host. That is, if a matching and
valid neighbor entry is configured on the VXLAN device whose MAC address
is not behind the "any" remote (0.0.0.0 / ::).

The code currently assumes that the FDB entry for the neighbor's MAC
address points to a valid remote destination, but this is incorrect if
the entry is associated with an FDB nexthop group. This can result in a
NPD [1][3] which can be reproduced using [2][4].

Fix by checking that the remote destination exists before dereferencing
it.

[1]
BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
CPU: 4 UID: 0 PID: 365 Comm: arping Not tainted 6.17.0-rc2-virtme-g2a89cb21162c #2 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014
RIP: 0010:vxlan_xmit+0xb58/0x15f0
[...]
Call Trace:
 <TASK>
 dev_hard_start_xmit+0x5d/0x1c0
 __dev_queue_xmit+0x246/0xfd0
 packet_sendmsg+0x113a/0x1850
 __sock_sendmsg+0x38/0x70
 __sys_sendto+0x126/0x180
 __x64_sys_sendto+0x24/0x30
 do_syscall_64+0xa4/0x260
 entry_SYSCALL_64_after_hwframe+0x4b/0x53

[2]
 #!/bin/bash

 ip address add 192.0.2.1/32 dev lo

 ip nexthop add id 1 via 192.0.2.2 fdb
 ip nexthop add id 10 group 1 fdb

 ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 4789 proxy

 ip neigh add 192.0.2.3 lladdr 00:11:22:33:44:55 nud perm dev vx0

 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10

 arping -b -c 1 -s 192.0.2.1 -I vx0 192.0.2.3

[3]
BUG: kernel NULL pointer dereference, address: 0000000000000000
[...]
CPU: 13 UID: 0 PID: 372 Comm: ndisc6 Not tainted 6.17.0-rc2-virtmne-g6ee90cb26014 #3 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1v996), BIOS 1.17.0-4.fc41 04/01/2x014
RIP: 0010:vxlan_xmit+0x803/0x1600
[...]
Call Trace:
 <TASK>
 dev_hard_start_xmit+0x5d/0x1c0
 __dev_queue_xmit+0x246/0xfd0
 ip6_finish_output2+0x210/0x6c0
 ip6_finish_output+0x1af/0x2b0
 ip6_mr_output+0x92/0x3e0
 ip6_send_skb+0x30/0x90
 rawv6_sendmsg+0xe6e/0x12e0
 __sock_sendmsg+0x38/0x70
 __sys_sendto+0x126/0x180
 __x64_sys_sendto+0x24/0x30
 do_syscall_64+0xa4/0x260
 entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7f383422ec77

[4]
 #!/bin/bash

 ip address add 2001:db8:1::1/128 dev lo

 ip nexthop add id 1 via 2001:db8:1::1 fdb
 ip nexthop add id 10 group 1 fdb

 ip link add name vx0 up type vxlan id 10010 local 2001:db8:1::1 dstport 4789 proxy

 ip neigh add 2001:db8:1::3 lladdr 00:11:22:33:44:55 nud perm dev vx0

 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10

 ndisc6 -r 1 -s 2001:db8:1::1 -w 1 2001:db8:1::3 vx0

## Affected

- `Linux >= 1274e1cc42264d4e629841e4f182795cb0becfd2 < 87cd41faceb0eea6201d32d6b11f861ea30591ae`
- `Linux >= 1274e1cc42264d4e629841e4f182795cb0becfd2 < 8ba034c41b20dc4f32ece748f1429709ae8ceedc`
- `Linux >= 1274e1cc42264d4e629841e4f182795cb0becfd2 < e211e3f4199ac829bd493632efcd131d337cba9d`
- `Linux >= 1274e1cc42264d4e629841e4f182795cb0becfd2 < 8cfa0f076842f9b3b4eb52ae0e41d16e25cbf8fa`
- `Linux >= 1274e1cc42264d4e629841e4f182795cb0becfd2 < 1f5d2fd1ca04a23c18b1bde9a43ce2fa2ffa1bce`
- `Linux 5.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.