Junglewise Threat Intelligence

CVE-2025-39894: Linux Kernel denial of service in br_netfilter conntrack confirmation

CVE-2025-39894 · Severity: high · CVSS 7.5 · Published 2025-10-01

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's networking component, specifically affecting how it handles network bridges and connection tracking. Under certain conditions involving broadcast traffic, the system may trigger an internal error (kernel warning) due to a conflict in how network connections are recorded. This could potentially lead to system instability or a denial of service, impacting the availability of network-dependent operations.

Technical details

The vulnerability exists in the br_nf_local_in() function within net/bridge/br_netfilter_hooks.c. When a broadcast packet is sent to a tap device on a bridge, the kernel attempts to confirm the conntrack entry. If a hash conflict occurs (e.g., another conntrack with the same hash is added simultaneously), nf_ct_resolve_clash() merges the entries and updates the socket buffer (_nfct), but br_nf_local_in() continues to reference the stale local 'nfct' variable. This mismatch triggers a WARN_ON_ONCE check for the 'confirmed' bit. The fix involves removing the unnecessary check, as the conntrack state is managed elsewhere during clash resolution. The issue was introduced by a previous change intended to confirm multicast packets before passing them up the stack.

Affected products

  • Linux Linux Kernel 5.15.151 to 5.15.192, 6.1.81 to 6.1.151, 6.6.21 to 6.6.105, 6.7.9 to 6.8

Timeline

  • 2025-08-27: patched: Mainline patch committed by Florian Westphal
  • 2025-10-01: disclosed: CVE published to NVD

References

Related threats