In the Linux kernel, the following vulnerability has been resolved:
vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects
When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of the remote host. That is, if a matching and valid neighbor entry is configured on the VXLAN device whose MAC address is not behind the "any" remote (0.0.0.0 / ::).
The code currently assumes that the FDB entry for the neighbor's MAC address points to a valid remote destination, but this is incorrect if the entry is associated with an FDB nexthop group. This can result in a NPD [1][3] which can be reproduced using [2][4].
Fix by checking that the remote destination exists before dereferencing it.
[1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 4 UID: 0 PID: 365 Comm: arping Not tainted 6.17.0-rc2-virtme-g2a89cb21162c #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlan_xmit+0xb58/0x15f0 [...] Call Trace: <TASK> dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53
[2] #!/bin/bash
ip address add 192.0.2.1/32 dev lo
ip nexthop add id 1 via 192.0.2.2 fdb ip nexthop add id 10 group 1 fdb
ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 4789 proxy
ip neigh add 192.0.2.3 lladdr 00:11:22:33:44:55 nud perm dev vx0
bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10
arping -b -c 1 -s 192.0.2.1 -I vx0 192.0.2.3
[3] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID: 0 PID: 372 Comm: ndisc6 Not tainted 6.17.0-rc2-virtmne-g6ee90cb26014 #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1v996), BIOS 1.17.0-4.fc41 04/01/2x014 RIP: 0010:vxlan_xmit+0x803/0x1600 [...] Call Trace: <TASK> dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 ip6_finish_output2+0x210/0x6c0 ip6_finish_output+0x1af/0x2b0 ip6_mr_output+0x92/0x3e0 ip6_send_skb+0x30/0x90 rawv6_sendmsg+0xe6e/0x12e0 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f383422ec77
[4] #!/bin/bash
ip address add 2001:db8:1::1/128 dev lo
ip nexthop add id 1 via 2001:db8:1::1 fdb ip nexthop add id 10 group 1 fdb
ip link add name vx0 up type vxlan id 10010 local 2001:db8:1::1 dstport 4789 proxy
ip neigh add 2001:db8:1::3 lladdr 00:11:22:33:44:55 nud perm dev vx0
bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10
ndisc6 -r 1 -s 2001:db8:1::1 -w 1 2001:db8:1::3 vx0
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade bpftool6.12-debuginfoUpgrade kernel6.12-libbpf-develUpgrade kernel6.12-modules-extraUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-tools-develUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12Upgrade perf6.12-debuginfoUpgrade bpftool6.12Upgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-libbpfUpgrade kernel-livepatch-6.12.46-66.121Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-debuginfoUpgrade kernel6.12-headersUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-toolsUpgrade perf6.12Upgrade python3-perf6.12Upgrade kernel6.12-develUpgrade python3-perf6.12-debuginfo | Oct 16, 2025 | Sep 19, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-perfUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade kernel | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel | Jan 15, 2026 | Jan 6, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernelUpgrade kernel-tools | Dec 12, 2025 | Dec 11, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Nov 11, 2025 | Sep 19, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 19, 2025 |
| Suse | — | Upgrade dtb-lgUpgrade kernel-64kb-develUpgrade kernel-devel-azureUpgrade kernel-default-base-rebuildUpgrade kernel-rt-develUpgrade cluster-md-kmp-rtUpgrade dtb-armUpgrade dtb-mediatekUpgrade kernel-sourceUpgrade gfs2-kmp-azureUpgrade ocfs2-kmp-azureUpgrade dtb-allwinnerUpgrade dtb-alteraUpgrade cluster-md-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-syms-azureUpgrade reiserfs-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade dtb-xilinxUpgrade cluster-md-kmp-64kbUpgrade dtb-exynosUpgrade kernel-azure-optionalUpgrade kernel-devel-rtUpgrade kernel-symsUpgrade dtb-rockchipUpgrade dlm-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-develUpgrade kernel-rt-livepatchUpgrade dlm-kmp-rtUpgrade dtb-sprdUpgrade gfs2-kmp-defaultUpgrade kernel-default-vdsoUpgrade kernel-rtUpgrade kselftests-kmp-64kbUpgrade dtb-nvidiaUpgrade kernel-source-azureUpgrade dtb-hisiliconUpgrade dtb-qcomUpgrade kernel-default-optionalUpgrade dtb-renesasUpgrade dtb-caviumUpgrade gfs2-kmp-64kbUpgrade kernel-debugUpgrade kernel-default-extraUpgrade kernel-default-baseUpgrade kernel-64kb-optionalUpgrade dtb-broadcomUpgrade kernel-kvmsmall-develUpgrade dtb-appleUpgrade dtb-apmUpgrade dtb-amlogicUpgrade kernel-obs-buildUpgrade dtb-amdUpgrade kselftests-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-extraUpgrade kernel-azureUpgrade dlm-kmp-azureUpgrade gfs2-kmp-rtUpgrade kernel-syms-rtUpgrade kernel-default-develUpgrade dtb-socionextUpgrade kernel-kvmsmallUpgrade kernel-zfcpdumpUpgrade kernel-rt_debugUpgrade kernel-64kbUpgrade kernel-rt-extraUpgrade kernel-debug-vdsoUpgrade dtb-freescaleUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-source-vanillaUpgrade dtb-amazonUpgrade reiserfs-kmp-rtUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-macrosUpgrade kernel-defaultUpgrade kernel-azure-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-obs-qaUpgrade kernel-default-livepatch-develUpgrade kernel-debug-develUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt_debug-develUpgrade kernel-source-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-docs-htmlUpgrade dtb-marvellUpgrade kernel-azure-develUpgrade kernel-docsUpgrade kernel-default-livepatchUpgrade kernel-rt-optional | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-aws-fipsUpgrade linux-image-awsUpgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-1048-gke-64kUpgrade linux-image-6.8.0-106-genericUpgrade linux-image-aws-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-oem-22.04aUpgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1047-oracle-64kUpgrade linux-image-6.8.0-1050-aws-fipsUpgrade linux-image-azure-lts-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azure-fipsUpgrade linux-image-lowlatency-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-generic-64k-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-ibmUpgrade linux-image-6.8.0-1050-aws-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-6.8.0-1050-raspiUpgrade linux-image-6.8.0-1052-gcpUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-106-lowlatency-64kUpgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-2040-raspi-realtimeUpgrade linux-image-ibm-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-aws-64k-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-kvmUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1049-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1052-gcp-fipsUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-azureUpgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-106-lowlatencyUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-aws-fips-6.8Upgrade linux-image-gke-64kUpgrade linux-image-fipsUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-6.8.0-1050-awsUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1052-azure-fipsUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-6.8.0-106-fipsUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-oracleUpgrade linux-image-oracle-64kUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1035-gkeopUpgrade linux-image-gcpUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1049-nvidiaUpgrade linux-image-6.8.0-1047-oracleUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.8.0-1048-gkeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-aws-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1049-ibmUpgrade linux-image-nvidiaUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-xilinxUpgrade linux-image-gke-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1049-nvidia-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-genericUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-intel-iotgUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-6.8.0-1052-gcp-64kUpgrade linux-image-6.8.0-106-generic-64kUpgrade linux-image-oracle-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-gkeopUpgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.1-1045-realtimeUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1049-nvidia-64kUpgrade linux-image-fips-6.8Upgrade linux-image-oem-22.04bUpgrade linux-image-oem-22.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-azure-6.8 | Mar 17, 2026 | Sep 19, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub