CVE-2025-39850: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39850 is a vulnerability discovered in the Linux kernel affecting the VXLAN (Virtual Extensible LAN) implementation. The vulnerability was disclosed on September 19, 2025, and involves a NULL pointer dereference in the {arp,neigh}_reduce() functions when using nexthop objects (NVD).

The vulnerability occurs when the 'proxy' option is enabled on a VXLAN device. In this configuration, the device suppresses ARP requests and IPv6 Neighbor Solicitation messages if it can reply on behalf of the remote host. The issue arises when there is a matching and valid neighbor entry configured on the VXLAN device whose MAC address is not behind the 'any' remote (0.0.0.0 / ::). The code incorrectly assumes that the FDB entry for the neighbor's MAC address points to a valid remote destination, which is not true when the entry is associated with an FDB nexthop group. This results in a NULL pointer dereference (NVD). The vulnerability has been assigned a CVSS v3.1 base score of 7.0 (Red Hat).

The vulnerability can lead to a NULL pointer dereference in the Linux kernel, potentially causing system crashes or denial of service conditions when processing VXLAN traffic under specific configurations (NVD).

The vulnerability has been fixed by implementing a check that verifies the remote destination exists before dereferencing it. The fix has been incorporated into the Linux kernel codebase (NVD).