In the Linux kernel, the following vulnerability has been resolved:
nexthop: Forbid FDB status change while nexthop is in a group
The kernel forbids the creation of non-FDB nexthop groups with FDB nexthops:
# ip nexthop add id 1 via 192.0.2.1 fdb # ip nexthop add id 2 group 1 Error: Non FDB nexthop group cannot have fdb nexthops.
And vice versa:
# ip nexthop add id 3 via 192.0.2.2 dev dummy1 # ip nexthop add id 4 group 3 fdb Error: FDB nexthop group can only have fdb nexthops.
However, as long as no routes are pointing to a non-FDB nexthop group, the kernel allows changing the type of a nexthop from FDB to non-FDB and vice versa:
# ip nexthop add id 5 via 192.0.2.2 dev dummy1 # ip nexthop add id 6 group 5 # ip nexthop replace id 5 via 192.0.2.2 fdb # echo $? 0
This configuration is invalid and can result in a NPD [1] since FDB nexthops are not associated with a nexthop device:
# ip route add 198.51.100.1/32 nhid 6 # ping 198.51.100.1
Fix by preventing nexthop FDB status change while the nexthop is in a group:
# ip nexthop add id 7 via 192.0.2.2 dev dummy1 # ip nexthop add id 8 group 7 # ip nexthop replace id 7 via 192.0.2.2 fdb Error: Cannot change nexthop FDB status while in a group.
[1] BUG: kernel NULL pointer dereference, address: 00000000000003c0 [...] Oops: Oops: 0000 [#1] SMP CPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:fib_lookup_good_nhc+0x1e/0x80 [...] Call Trace: <TASK> fib_table_lookup+0x541/0x650 ip_route_output_key_hash_rcu+0x2ea/0x970 ip_route_output_key_hash+0x55/0x80 __ip4_datagram_connect+0x250/0x330 udp_connect+0x2b/0x60 __sys_connect+0x9c/0xd0 __x64_sys_connect+0x18/0x20 do_syscall_64+0xa4/0x2a0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade python-perfUpgrade kernel-debuginfo-common-aarch64Upgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade kernel-headersUpgrade perfUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-livepatch-5.10.245-241.976Upgrade kernelUpgrade kernel-livepatch-5.15.194-135.217Upgrade kernel-develUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernelUpgrade kernel6.12-modules-extraUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel-livepatch-6.12.53-69.119Upgrade kernel-livepatch-6.1.155-176.282Upgrade perf-debuginfoUpgrade kernel6.12-libbpfUpgrade perfUpgrade kernel-headersUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade python3-perfUpgrade bpftool6.12Upgrade kernel6.12-toolsUpgrade kernel6.12-tools-develUpgrade bpftool6.12-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-toolsUpgrade kernel6.12-libbpf-develUpgrade kernel6.12-tools-debuginfoUpgrade kernel-develUpgrade kernel6.12-headersUpgrade kernel-libbpfUpgrade python3-perf6.12Upgrade bpftoolUpgrade kernel6.12-develUpgrade kernel-modules-extraUpgrade kernel-libbpf-debuginfoUpgrade bpftool-debuginfoUpgrade perf6.12Upgrade kernel6.12Upgrade kernel-libbpf-staticUpgrade kernel6.12-modules-extra-commonUpgrade kernel-tools-debuginfoUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel6.12-debuginfo-common-x86_64 | Nov 11, 2025 | Oct 15, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Nov 13, 2025 | Nov 13, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade bpftoolUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perf | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelists | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernel | Feb 3, 2026 | Feb 2, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Dec 15, 2025 | Oct 15, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-gcp-fipsUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-2040-raspi-realtimeUpgrade linux-image-6.8.0-1049-ibmUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-170-generic-lpaeUpgrade linux-image-ibmUpgrade linux-image-6.8.0-106-genericUpgrade linux-image-generic-64k-5.15Upgrade linux-image-nvidia-5.15Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1050-awsUpgrade linux-image-5.15.0-1094-ibmUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-oem-22.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-nvidia-tegraUpgrade linux-image-genericUpgrade linux-image-fipsUpgrade linux-image-virtual-6.8Upgrade linux-image-5.15.0-1092-kvmUpgrade linux-image-5.15.0-1100-aws-64kUpgrade linux-image-5.15.0-1041-nvidia-tegra-igx-rtUpgrade linux-image-6.8.1-1045-realtimeUpgrade linux-image-5.15.0-1095-intel-iotgUpgrade linux-image-nvidiaUpgrade linux-image-raspi-realtimeUpgrade linux-image-fips-5.15Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-gcpUpgrade linux-image-generic-6.8Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1095-nvidiaUpgrade linux-image-oem-22.04aUpgrade linux-image-gke-5.15Upgrade linux-image-6.8.0-1052-gcp-64kUpgrade linux-image-6.8.0-1035-gkeopUpgrade linux-image-5.15.0-1064-xilinx-zynqmpUpgrade linux-image-5.15.0-1109-azureUpgrade linux-image-xilinxUpgrade linux-image-generic-64k-6.8Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-raspiUpgrade linux-image-generic-lpaeUpgrade linux-image-gkeop-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-ibm-6.8Upgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-6.8.0-1049-nvidiaUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-170-lowlatency-64kUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1052-nvidia-tegra-rtUpgrade linux-image-fips-6.8Upgrade linux-image-5.15.0-170-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-oracle-5.15Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-generic-5.15Upgrade linux-image-intelUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-aws-fipsUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-1096-gkeUpgrade linux-image-5.15.0-1109-azure-fipsUpgrade linux-image-kvm-5.15Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-oem-22.04cUpgrade linux-image-azure-fips-6.8Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-gke-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gke-6.8Upgrade linux-image-azureUpgrade linux-image-6.8.0-1050-aws-64kUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.8.0-1048-gkeUpgrade linux-image-6.8.0-1048-gke-64kUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-6.8.0-1049-nvidia-lowlatencyUpgrade linux-image-6.8.0-1052-azure-fipsUpgrade linux-image-oem-20.04cUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-6.8.0-106-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-oem-20.04bUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-aws-64k-6.8Upgrade linux-image-generic-64kUpgrade linux-image-5.15.0-1097-raspiUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1110-azureUpgrade linux-image-raspi-5.15Upgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-1047-oracle-64kUpgrade linux-image-5.15.0-170-genericUpgrade linux-image-5.15.0-1100-gcp-fipsUpgrade linux-image-5.15.0-1100-gcpUpgrade linux-image-oem-20.04dUpgrade linux-image-aws-lts-24.04Upgrade linux-image-6.8.0-1047-oracleUpgrade linux-image-5.15.0-1092-intel-iot-realtimeUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-106-fipsUpgrade linux-image-virtual-5.15Upgrade linux-image-realtime-5.15Upgrade linux-image-ibm-5.15Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-azure-6.8Upgrade linux-image-aws-64kUpgrade linux-image-5.15.0-1099-realtimeUpgrade linux-image-azure-5.15Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1049-nvidia-64kUpgrade linux-image-gkeop-5.15Upgrade linux-image-aws-fips-5.15Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-5.15.0-1100-aws-fipsUpgrade linux-image-5.15.0-1041-nvidia-tegra-igxUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1052-gcpUpgrade linux-image-5.15.0-170-generic-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-realtimeUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-gkeUpgrade linux-image-azure-fipsUpgrade linux-image-aws-64k-5.15Upgrade linux-image-awsUpgrade linux-image-6.8.0-1049-nvidia-lowlatency-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oracle-6.8Upgrade linux-image-oracleUpgrade linux-image-oem-22.04dUpgrade linux-image-kvmUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-aws-5.15Upgrade linux-image-6.8.0-1052-gcp-fipsUpgrade linux-image-6.8.0-106-generic-64kUpgrade linux-image-5.15.0-1083-gkeopUpgrade linux-image-5.15.0-1095-nvidia-lowlatencyUpgrade linux-image-gcp-64kUpgrade linux-image-oem-20.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-raspi-nolpaeUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-6.8.0-1050-raspiUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.8.0-1050-aws-fipsUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-gke-64k-6.8Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-5.15.0-170-lowlatencyUpgrade linux-image-5.15.0-1052-nvidia-tegraUpgrade linux-image-5.15.0-1100-awsUpgrade linux-image-virtualUpgrade linux-image-realtime-6.8.1Upgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-gcp-5.15Upgrade linux-image-5.15.0-1097-oracleUpgrade linux-image-azure-fips-5.15Upgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-106-lowlatencyUpgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-raspi-6.8Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatency-5.15Upgrade linux-image-gcp-6.8Upgrade linux-image-gcp-fips-5.15 | Oct 30, 2025 | Oct 15, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Oct 15, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub