{"id":"CVE-2025-39980","revision":"c89a7f85f6aa4f018a3293e9e93302f5","records":[{"revision":"c89a7f85f6aa4f018a3293e9e93302f5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-39980","aliases":[],"title":"nexthop: Forbid FDB status change while nexthop is in a group","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: Forbid FDB status change while nexthop is in a group\n\nThe kernel forbids the creation of non-FDB nexthop groups with FDB\nnexthops:\n\n # ip nexthop add id 1 via 192.0.2.1 fdb\n # ip nexthop add id 2 group 1\n Error: Non FDB nexthop group cannot have fdb nexthops.\n\nAnd vice versa:\n\n # ip nexthop add id 3 via 192.0.2.2 dev dummy1\n # ip nexthop add id 4 group 3 fdb\n Error: FDB nexthop group can only have fdb nexthops.\n\nHowever, as long as no routes are pointing to a non-FDB nexthop group,\nthe kernel allows changing the type of a nexthop from FDB to non-FDB and\nvice versa:\n\n # ip nexthop add id 5 via 192.0.2.2 dev dummy1\n # ip nexthop add id 6 group 5\n # ip nexthop replace id 5 via 192.0.2.2 fdb\n # echo $?\n 0\n\nThis configuration is invalid and can result in a NPD [1] since FDB\nnexthops are not associated with a nexthop device:\n\n # ip route add 198.51.100.1/32 nhid 6\n # ping 198.51.100.1\n\nFix by preventing nexthop FDB status change while the nexthop is in a\ngroup:\n\n # ip nexthop add id 7 via 192.0.2.2 dev dummy1\n # ip nexthop add id 8 group 7\n # ip nexthop replace id 7 via 192.0.2.2 fdb\n Error: Cannot change nexthop FDB status while in a group.\n\n[1]\nBUG: kernel NULL pointer dereference, address: 00000000000003c0\n[...]\nOops: Oops: 0000 [#1] SMP\nCPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014\nRIP: 0010:fib_lookup_good_nhc+0x1e/0x80\n[...]\nCall Trace:\n \n fib_table_lookup+0x541/0x650\n ip_route_output_key_hash_rcu+0x2ea/0x970\n ip_route_output_key_hash+0x55/0x80\n __ip4_datagram_connect+0x250/0x330\n udp_connect+0x2b/0x60\n __sys_connect+0x9c/0xd0\n __x64_sys_connect+0x18/0x20\n do_syscall_64+0xa4/0x2a0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53","state":0,"publishedAt":"2025-10-15T07:56:00.275+00:00","modifiedAt":"2026-10-15T01:08:47.582+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/ipv4/nexthop.c\"\n ],\n \"versions\": [\n {\n \"version\": \"38428d68719c454d269cb03b776d8a4b0ad66111\",\n \"lessThan\": \"e1e87ac0daacd51f522ecd1645cd76b5809303ed\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"38428d68719c454d269cb03b776d8a4b0ad66111\",\n \"lessThan\": \"0e7bfe7a268ccbd7859730c529161cafbf44637c\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"38428d68719c454d269cb03b776d8a4b0ad66111\",\n \"lessThan\": \"ec428fff792b7bd15b248dafca2e654b666b1304\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"38428d68719c454d269cb03b776d8a4b0ad66111\",\n \"lessThan\": \"24046d31f6f92220852d393d510b6062843e3fbd\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"38428d68719c454d269cb03b776d8a4b0ad66111\",\n \"lessThan\": \"f0e49fd13afe9dea7a09a1c9537fd00cea22badb\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"38428d68719c454d269cb03b776d8a4b0ad66111\",\n \"lessThan\": \"8dd4aa0122885f710930de135af2adc4ccc3238f\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"38428d68719c454d269cb03b776d8a4b0ad66111\",\n \"lessThan\": \"390b3a300d7872cef9588f003b204398be69ce08\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/ipv4/nexthop.c\"\n ],\n \"versions\": [\n {\n \"version\": \"5.8\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"5.8\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.245\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.194\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.155\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.109\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.50\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.16.10\",\n \"lessThanOrEqual\": \"6.16.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.17\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/e1e87ac0daacd51f522ecd1645cd76b5809303ed","https://git.kernel.org/stable/c/0e7bfe7a268ccbd7859730c529161cafbf44637c","https://git.kernel.org/stable/c/ec428fff792b7bd15b248dafca2e654b666b1304","https://git.kernel.org/stable/c/24046d31f6f92220852d393d510b6062843e3fbd","https://git.kernel.org/stable/c/f0e49fd13afe9dea7a09a1c9537fd00cea22badb","https://git.kernel.org/stable/c/8dd4aa0122885f710930de135af2adc4ccc3238f","https://git.kernel.org/stable/c/390b3a300d7872cef9588f003b204398be69ce08"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39980","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-39980","identifiers":["CVE-2025-39980"]},"retained":false,"historicalAffected":[]}],"coverage":[]}