Security readout for executives and security teams
Plain-English summary
A flaw in the Linux VXLAN networking code can cause a kernel NULL-pointer dereference and potentially crash the system. It occurs when an incoming packet refreshes a forwarding entry tied to a nexthop group while VXLAN learning is enabled. The primary business risk is service disruption on affected network infrastructure or hosts.
Executive priority
Prioritize affected VXLAN or EVPN infrastructure because successful triggering may interrupt network or host availability without authentication. Patch reachable production systems promptly after compatibility testing. Systems not using the specific VXLAN learning and nexthop-group combination are lower priority, but version and configuration evidence should support that conclusion.
Technical view
CVE-2025-39851 is a CWE-476 flaw in vxlan_snoop(). An FDB nexthop-group entry has no remote destination, but the vulnerable path dereferences that missing remote before rejecting the packet. The upstream correction moves the rejection earlier. CVSS 3.1 rates it 7.5: network-accessible, low complexity, unauthenticated, and availability-only.
Likely exposure
Exposure is concentrated in Linux systems using VXLAN with learning enabled and FDB entries referencing nexthop groups, commonly associated with EVPN deployments. An attacker must be able to deliver relevant traffic into the affected VXLAN forwarding path. The supplied version data includes 5.8, 6.12.46, 6.16.6, and 6.17, but distro backports require verification.
Exploitation context
The supplied record is not in CISA KEV and provides no evidence of active exploitation. A reproducer existed for confirming the crash, but that alone does not establish real-world attacks. Practical reachability depends on VXLAN topology and traffic access.
Researcher notes
The vulnerable state requires an FDB entry backed by an FDB nexthop group, no remote destination, and a learning-enabled VXLAN path attempting a refresh. The fix drops the packet before remote dereference. The supplied affected-version representation is incomplete or ambiguous, so map upstream commits to distribution packages before declaring exposure or remediation.
Mitigation direction
- Apply a vendor-supported kernel containing the referenced VXLAN fix.
- Check distribution advisories for backported fixes and corrected package versions.
- Restrict untrusted traffic from reaching affected VXLAN forwarding paths until patched.
- Disable unnecessary VXLAN learning or affected configurations only after operational review.
Validation and detection
- Inventory Linux kernel versions on systems providing VXLAN or EVPN networking.
- Identify VXLAN interfaces using learning alongside FDB nexthop-group entries.
- Confirm the installed vendor kernel incorporates the applicable referenced fix.
- Review kernel logs for NULL-pointer dereferences involving vxlan_snoop.
- Validate remediation safely in staging without reproducing the crash in production.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-39851 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4ff4f3104da6507e0f118c63c4560dfdeb59dce3CVE reference, Linux
- https://git.kernel.org/stable/c/0e8630f24c14d9c655d19eabe2e52a9e9f713307CVE reference, Linux
- https://git.kernel.org/stable/c/6ead38147ebb813f08be6ea8ef547a0e4c09559aCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.