Junglewise Threat Intelligence

CVE-2025-39980: Linux kernel NULL pointer dereference in nexthop FDB status change

CVE-2025-39980 · Severity: info · Published 2025-10-15

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow a local user with administrative privileges to crash the system. The issue occurs when specific network routing configurations (nexthops) are modified in a way that the kernel does not expect, leading to a system failure. This could result in a complete denial of service for the affected device or server.

Technical details

A NULL pointer dereference (NPD) exists in the Linux kernel's nexthop implementation within net/ipv4/nexthop.c. The vulnerability is rooted in the `replace_nexthop_single` function, which failed to prevent changing a nexthop's Forwarding Database (FDB) status while that nexthop was a member of a nexthop group. Because FDB nexthops are not associated with a specific nexthop device, this inconsistent state causes `fib_lookup_good_nhc` to dereference a NULL pointer when processing routes associated with the group. An attacker with CAP_NET_ADMIN privileges can exploit this by creating a nexthop group and then using 'ip nexthop replace' to toggle the FDB flag, subsequently triggering the crash via network traffic. The fix introduces a check to forbid FDB status changes for nexthops currently in a group.

Affected products

  • Linux Linux Kernel 38428d68719c to 390b3a300d78
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2025-09-21: disclosed: Initial patch submission by Ido Schimmel
  • 2025-09-23: patched: Mainline kernel patch committed
  • 2025-10-15: advisory: CVE-2025-39980 published

References

Related threats