linux-cve-announce - CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025101559-CVE-2025-39980-1b78@gregkh>
Date: Wed, 15 Oct 2025 09:57:08 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-39980: nexthop: Forbid FDB status change while nexthop is in a group

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

nexthop: Forbid FDB status change while nexthop is in a group

The kernel forbids the creation of non-FDB nexthop groups with FDB
nexthops:

 # ip nexthop add id 1 via 192.0.2.1 fdb
 # ip nexthop add id 2 group 1
 Error: Non FDB nexthop group cannot have fdb nexthops.

And vice versa:

 # ip nexthop add id 3 via 192.0.2.2 dev dummy1
 # ip nexthop add id 4 group 3 fdb
 Error: FDB nexthop group can only have fdb nexthops.

However, as long as no routes are pointing to a non-FDB nexthop group,
the kernel allows changing the type of a nexthop from FDB to non-FDB and
vice versa:

 # ip nexthop add id 5 via 192.0.2.2 dev dummy1
 # ip nexthop add id 6 group 5
 # ip nexthop replace id 5 via 192.0.2.2 fdb
 # echo $?
 0

This configuration is invalid and can result in a NPD [1] since FDB
nexthops are not associated with a nexthop device:

 # ip route add 198.51.100.1/32 nhid 6
 # ping 198.51.100.1

Fix by preventing nexthop FDB status change while the nexthop is in a
group:

 # ip nexthop add id 7 via 192.0.2.2 dev dummy1
 # ip nexthop add id 8 group 7
 # ip nexthop replace id 7 via 192.0.2.2 fdb
 Error: Cannot change nexthop FDB status while in a group.

[1]
BUG: kernel NULL pointer dereference, address: 00000000000003c0
[...]
Oops: Oops: 0000 [#1] SMP
CPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014
RIP: 0010:fib_lookup_good_nhc+0x1e/0x80
[...]
Call Trace:
 <TASK>
 fib_table_lookup+0x541/0x650
 ip_route_output_key_hash_rcu+0x2ea/0x970
 ip_route_output_key_hash+0x55/0x80
 __ip4_datagram_connect+0x250/0x330
 udp_connect+0x2b/0x60
 __sys_connect+0x9c/0xd0
 __x64_sys_connect+0x18/0x20
 do_syscall_64+0xa4/0x2a0
 entry_SYSCALL_64_after_hwframe+0x4b/0x53

The Linux kernel CVE team has assigned CVE-2025-39980 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.8 with commit 38428d68719c454d269cb03b776d8a4b0ad66111 and fixed in 5.10.245 with commit e1e87ac0daacd51f522ecd1645cd76b5809303ed
	Issue introduced in 5.8 with commit 38428d68719c454d269cb03b776d8a4b0ad66111 and fixed in 5.15.194 with commit 0e7bfe7a268ccbd7859730c529161cafbf44637c
	Issue introduced in 5.8 with commit 38428d68719c454d269cb03b776d8a4b0ad66111 and fixed in 6.1.155 with commit ec428fff792b7bd15b248dafca2e654b666b1304
	Issue introduced in 5.8 with commit 38428d68719c454d269cb03b776d8a4b0ad66111 and fixed in 6.6.109 with commit 24046d31f6f92220852d393d510b6062843e3fbd
	Issue introduced in 5.8 with commit 38428d68719c454d269cb03b776d8a4b0ad66111 and fixed in 6.12.50 with commit f0e49fd13afe9dea7a09a1c9537fd00cea22badb
	Issue introduced in 5.8 with commit 38428d68719c454d269cb03b776d8a4b0ad66111 and fixed in 6.16.10 with commit 8dd4aa0122885f710930de135af2adc4ccc3238f
	Issue introduced in 5.8 with commit 38428d68719c454d269cb03b776d8a4b0ad66111 and fixed in 6.17 with commit 390b3a300d7872cef9588f003b204398be69ce08

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-39980
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/nexthop.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e1e87ac0daacd51f522ecd1645cd76b5809303ed
	https://git.kernel.org/stable/c/0e7bfe7a268ccbd7859730c529161cafbf44637c
	https://git.kernel.org/stable/c/ec428fff792b7bd15b248dafca2e654b666b1304
	https://git.kernel.org/stable/c/24046d31f6f92220852d393d510b6062843e3fbd
	https://git.kernel.org/stable/c/f0e49fd13afe9dea7a09a1c9537fd00cea22badb
	https://git.kernel.org/stable/c/8dd4aa0122885f710930de135af2adc4ccc3238f
	https://git.kernel.org/stable/c/390b3a300d7872cef9588f003b204398be69ce08