CVE-2025-39894

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39894", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.145Z", "datePublished": "2025-10-01T07:42:43.126Z", "dateUpdated": "2026-10-15T22:02:32.869Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:56.359Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm\n\nWhen send a broadcast packet to a tap device, which was added to a bridge,\nbr_nf_local_in() is called to confirm the conntrack. If another conntrack\nwith the same hash value is added to the hash table, which can be\ntriggered by a normal packet to a non-bridge device, the below warning\nmay happen.\n\n ------------[ cut here ]------------\n WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200\n CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)\n RIP: 0010:br_nf_local_in+0x168/0x200\n Call Trace:\n <TASK>\n nf_hook_slow+0x3e/0xf0\n br_pass_frame_up+0x103/0x180\n br_handle_frame_finish+0x2de/0x5b0\n br_nf_hook_thresh+0xc0/0x120\n br_nf_pre_routing_finish+0x168/0x3a0\n br_nf_pre_routing+0x237/0x5e0\n br_handle_frame+0x1ec/0x3c0\n __netif_receive_skb_core+0x225/0x1210\n __netif_receive_skb_one_core+0x37/0xa0\n netif_receive_skb+0x36/0x160\n tun_get_user+0xa54/0x10c0\n tun_chr_write_iter+0x65/0xb0\n vfs_write+0x305/0x410\n ksys_write+0x60/0xd0\n do_syscall_64+0xa4/0x260\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n ---[ end trace 0000000000000000 ]---\n\nTo solve the hash conflict, nf_ct_resolve_clash() try to merge the\nconntracks, and update skb->_nfct. However, br_nf_local_in() still use the\nold ct from local variable 'nfct' after confirm(), which leads to this\nwarning.\n\nIf confirm() does not insert the conntrack entry and return NF_DROP, the\nwarning may also occur. There is no need to reserve the WARN_ON_ONCE, just\nremove it."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The trigger is a broadcast/multicast IP frame arriving on a bridge port and being locally delivered via br_pass_frame_up() \u2192 NF_BR_LOCAL_IN, requiring no host access at all; on the very common overlay deployments (VXLAN/GRE port enslaved to a Linux bridge in Docker overlay, k8s CNI, OpenStack) those inner broadcast frames originate from a routed, remote VTEP, making the vulnerable code reachable across layer 3.\nAC:L - The attacker drives both sides of the clash by flooding duplicate same-tuple broadcast datagrams, which the bridge itself fans out concurrently (flood to N ports plus local receive, plus a copy to a non-bridge device as noted in the commit), so two unconfirmed conntracks with an identical tuple reach __nf_conntrack_confirm() in parallel. The required br_netfilter+conntrack+bridge configuration is the default on container and virtualization hosts, not a rare option.\nPR:N - No credentials or capabilities on the target are needed \u2014 the attacker only has to get an IP broadcast/multicast frame onto a segment bridged by the victim, which is unauthenticated packet delivery.\nUI:N - No victim action is required; the bridge processes the received frames automatically in softirq context.\nS:U - The stale conntrack read and the WARNING both occur in the host kernel's own netfilter/bridge context, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:N - The stale read is a single unsigned long from a SLAB_TYPESAFE_BY_RCU nf_conn object and its value is consumed only by the WARN condition \u2014 it is never returned to the attacker, and the remote attacker has no channel to read the resulting dmesg splat.\nI:N - No write occurs on the stale pointer; confirm() has already repointed skb->_nfct at the surviving conntrack with a valid reference, so no kernel memory is modified and no control flow is influenced.\nA:H - The bug fires a kernel WARNING from a remotely reachable softirq path, which taints the kernel and causes an immediate panic on the many hardened, Android, ChromeOS, and cloud/CI deployments that run with panic_on_warn=1, yielding a full denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_netfilter_hooks.c"], "versions": [{"version": "7c3f28599652acf431a2211168de4a583f30b6d5", "lessThan": "d00c8b0daf56012f69075e3377da67878c775e4c", "status": "affected", "versionType": "git"}, {"version": "2b1414d5e94e477edff1d2c79030f1d742625ea0", "lessThan": "ccbad4803225eafe0175d3cb19f0d8d73b504a94", "status": "affected", "versionType": "git"}, {"version": "80cd0487f630b5382734997c3e5e3003a77db315", "lessThan": "50db11e2bbb635e38e3dd096215580d6adb41fb0", "status": "affected", "versionType": "git"}, {"version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9", "lessThan": "c47ca77fee9071aa543bae592dd2a384f895c8b6", "status": "affected", "versionType": "git"}, {"version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9", "lessThan": "a74abcf0f09f59daeecf7a3ba9c1d690808b0afe", "status": "affected", "versionType": "git"}, {"version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9", "lessThan": "479a54ab92087318514c82428a87af2d7af1a576", "status": "affected", "versionType": "git"}, {"version": "cb734975b0ffa688ff6cc0eed463865bf07b6c01", "status": "affected", "versionType": "git"}, {"version": "5.15.151", "lessThan": "5.15.192", "status": "affected", "versionType": "semver"}, {"version": "6.1.81", "lessThan": "6.1.151", "status": "affected", "versionType": "semver"}, {"version": "6.6.21", "lessThan": "6.6.105", "status": "affected", "versionType": "semver"}, {"version": "6.7.9", "lessThan": "6.8", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/br_netfilter_hooks.c"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.192", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.151", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.105", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.46", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.6", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.151", "versionEndExcluding": "5.15.192"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.81", "versionEndExcluding": "6.1.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.21", "versionEndExcluding": "6.6.105"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.16.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.9"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d00c8b0daf56012f69075e3377da67878c775e4c"}, {"url": "https://git.kernel.org/stable/c/ccbad4803225eafe0175d3cb19f0d8d73b504a94"}, {"url": "https://git.kernel.org/stable/c/50db11e2bbb635e38e3dd096215580d6adb41fb0"}, {"url": "https://git.kernel.org/stable/c/c47ca77fee9071aa543bae592dd2a384f895c8b6"}, {"url": "https://git.kernel.org/stable/c/a74abcf0f09f59daeecf7a3ba9c1d690808b0afe"}, {"url": "https://git.kernel.org/stable/c/479a54ab92087318514c82428a87af2d7af1a576"}], "title": "netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:44:28.733Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39894", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:54:35.991421Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:32.869Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:44:28.733Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39894", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T21:54:35.991421Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:54:36.670Z"}}], "cna": {"title": "netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The trigger is a broadcast/multicast IP frame arriving on a bridge port and being locally delivered via br_pass_frame_up() \u2192 NF_BR_LOCAL_IN, requiring no host access at all; on the very common overlay deployments (VXLAN/GRE port enslaved to a Linux bridge in Docker overlay, k8s CNI, OpenStack) those inner broadcast frames originate from a routed, remote VTEP, making the vulnerable code reachable across layer 3.\nAC:L - The attacker drives both sides of the clash by flooding duplicate same-tuple broadcast datagrams, which the bridge itself fans out concurrently (flood to N ports plus local receive, plus a copy to a non-bridge device as noted in the commit), so two unconfirmed conntracks with an identical tuple reach __nf_conntrack_confirm() in parallel. The required br_netfilter+conntrack+bridge configuration is the default on container and virtualization hosts, not a rare option.\nPR:N - No credentials or capabilities on the target are needed \u2014 the attacker only has to get an IP broadcast/multicast frame onto a segment bridged by the victim, which is unauthenticated packet delivery.\nUI:N - No victim action is required; the bridge processes the received frames automatically in softirq context.\nS:U - The stale conntrack read and the WARNING both occur in the host kernel's own netfilter/bridge context, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:N - The stale read is a single unsigned long from a SLAB_TYPESAFE_BY_RCU nf_conn object and its value is consumed only by the WARN condition \u2014 it is never returned to the attacker, and the remote attacker has no channel to read the resulting dmesg splat.\nI:N - No write occurs on the stale pointer; confirm() has already repointed skb->_nfct at the surviving conntrack with a valid reference, so no kernel memory is modified and no control flow is influenced.\nA:H - The bug fires a kernel WARNING from a remotely reachable softirq path, which taints the kernel and causes an immediate panic on the many hardened, Android, ChromeOS, and cloud/CI deployments that run with panic_on_warn=1, yielding a full denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7c3f28599652acf431a2211168de4a583f30b6d5", "lessThan": "d00c8b0daf56012f69075e3377da67878c775e4c", "versionType": "git"}, {"status": "affected", "version": "2b1414d5e94e477edff1d2c79030f1d742625ea0", "lessThan": "ccbad4803225eafe0175d3cb19f0d8d73b504a94", "versionType": "git"}, {"status": "affected", "version": "80cd0487f630b5382734997c3e5e3003a77db315", "lessThan": "50db11e2bbb635e38e3dd096215580d6adb41fb0", "versionType": "git"}, {"status": "affected", "version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9", "lessThan": "c47ca77fee9071aa543bae592dd2a384f895c8b6", "versionType": "git"}, {"status": "affected", "version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9", "lessThan": "a74abcf0f09f59daeecf7a3ba9c1d690808b0afe", "versionType": "git"}, {"status": "affected", "version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9", "lessThan": "479a54ab92087318514c82428a87af2d7af1a576", "versionType": "git"}, {"status": "affected", "version": "cb734975b0ffa688ff6cc0eed463865bf07b6c01", "versionType": "git"}, {"status": "affected", "version": "5.15.151", "lessThan": "5.15.192", "versionType": "semver"}, {"status": "affected", "version": "6.1.81", "lessThan": "6.1.151", "versionType": "semver"}, {"status": "affected", "version": "6.6.21", "lessThan": "6.6.105", "versionType": "semver"}, {"status": "affected", "version": "6.7.9", "lessThan": "6.8", "versionType": "semver"}], "programFiles": ["net/bridge/br_netfilter_hooks.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.192", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.151", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.105", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.46", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.16.6", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bridge/br_netfilter_hooks.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/d00c8b0daf56012f69075e3377da67878c775e4c"}, {"url": "https://git.kernel.org/stable/c/ccbad4803225eafe0175d3cb19f0d8d73b504a94"}, {"url": "https://git.kernel.org/stable/c/50db11e2bbb635e38e3dd096215580d6adb41fb0"}, {"url": "https://git.kernel.org/stable/c/c47ca77fee9071aa543bae592dd2a384f895c8b6"}, {"url": "https://git.kernel.org/stable/c/a74abcf0f09f59daeecf7a3ba9c1d690808b0afe"}, {"url": "https://git.kernel.org/stable/c/479a54ab92087318514c82428a87af2d7af1a576"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm\n\nWhen send a broadcast packet to a tap device, which was added to a bridge,\nbr_nf_local_in() is called to confirm the conntrack. If another conntrack\nwith the same hash value is added to the hash table, which can be\ntriggered by a normal packet to a non-bridge device, the below warning\nmay happen.\n\n ------------[ cut here ]------------\n WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200\n CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)\n RIP: 0010:br_nf_local_in+0x168/0x200\n Call Trace:\n <TASK>\n nf_hook_slow+0x3e/0xf0\n br_pass_frame_up+0x103/0x180\n br_handle_frame_finish+0x2de/0x5b0\n br_nf_hook_thresh+0xc0/0x120\n br_nf_pre_routing_finish+0x168/0x3a0\n br_nf_pre_routing+0x237/0x5e0\n br_handle_frame+0x1ec/0x3c0\n __netif_receive_skb_core+0x225/0x1210\n __netif_receive_skb_one_core+0x37/0xa0\n netif_receive_skb+0x36/0x160\n tun_get_user+0xa54/0x10c0\n tun_chr_write_iter+0x65/0xb0\n vfs_write+0x305/0x410\n ksys_write+0x60/0xd0\n do_syscall_64+0xa4/0x260\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n ---[ end trace 0000000000000000 ]---\n\nTo solve the hash conflict, nf_ct_resolve_clash() try to merge the\nconntracks, and update skb->_nfct. However, br_nf_local_in() still use the\nold ct from local variable 'nfct' after confirm(), which leads to this\nwarning.\n\nIf confirm() does not insert the conntrack entry and return NF_DROP, the\nwarning may also occur. There is no need to reserve the WARN_ON_ONCE, just\nremove it."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.192", "versionStartIncluding": "5.15.151"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.151", "versionStartIncluding": "6.1.81"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.105", "versionStartIncluding": "6.6.21"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.46", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16.6", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17", "versionStartIncluding": "6.8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.7.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:56.359Z"}}}, "cveMetadata": {"cveId": "CVE-2025-39894", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:32.869Z", "dateReserved": "2025-04-16T07:20:57.145Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-10-01T07:42:43.126Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bridge/br_netfilter_hooks.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d00c8b0daf56012f69075e3377da67878c775e4c", "status": "affected", "version": "7c3f28599652acf431a2211168de4a583f30b6d5", "versionType": "git"}, {"lessThan": "ccbad4803225eafe0175d3cb19f0d8d73b504a94", "status": "affected", "version": "2b1414d5e94e477edff1d2c79030f1d742625ea0", "versionType": "git"}, {"lessThan": "50db11e2bbb635e38e3dd096215580d6adb41fb0", "status": "affected", "version": "80cd0487f630b5382734997c3e5e3003a77db315", "versionType": "git"}, {"lessThan": "c47ca77fee9071aa543bae592dd2a384f895c8b6", "status": "affected", "version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9", "versionType": "git"}, {"lessThan": "a74abcf0f09f59daeecf7a3ba9c1d690808b0afe", "status": "affected", "version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9", "versionType": "git"}, {"lessThan": "479a54ab92087318514c82428a87af2d7af1a576", "status": "affected", "version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9", "versionType": "git"}, {"status": "affected", "version": "cb734975b0ffa688ff6cc0eed463865bf07b6c01", "versionType": "git"}, {"lessThan": "5.15.192", "status": "affected", "version": "5.15.151", "versionType": "semver"}, {"lessThan": "6.1.151", "status": "affected", "version": "6.1.81", "versionType": "semver"}, {"lessThan": "6.6.105", "status": "affected", "version": "6.6.21", "versionType": "semver"}, {"lessThan": "6.8", "status": "affected", "version": "6.7.9", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bridge/br_netfilter_hooks.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.192", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.151", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.105", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.46", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EAEDCA1A-2745-4005-85AE-39E44436B5D2", "versionEndExcluding": "5.15.192", "versionStartIncluding": "5.15.151", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CB3C782A-F7CE-4C5F-AA7F-B5FF3DCDA1AF", "versionEndExcluding": "6.1.151", "versionStartIncluding": "6.1.81", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "224C8BB6-3C4A-4887-98F0-6563C9376380", "versionEndExcluding": "6.6.105", "versionStartIncluding": "6.6.21", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "739125EE-99C1-42E1-B870-04FD5010BA66", "versionEndExcluding": "6.8", "versionStartIncluding": "6.7.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E12DFF9A-7ACE-4914-8CB1-28DB75F1E42B", "versionEndExcluding": "6.12.46", "versionStartIncluding": "6.8.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "548F104C-0F08-438B-9C97-64C903F0C678", "versionEndExcluding": "6.16.6", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:-:*:*:*:*:*:*", "matchCriteriaId": "41E47F32-BA80-4333-96FD-4D25082B0FDD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc7:*:*:*:*:*:*", "matchCriteriaId": "C9B8A5CE-6D20-4C36-AC01-ACA4B70003A8", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*", "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*", "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm\n\nWhen send a broadcast packet to a tap device, which was added to a bridge,\nbr_nf_local_in() is called to confirm the conntrack. If another conntrack\nwith the same hash value is added to the hash table, which can be\ntriggered by a normal packet to a non-bridge device, the below warning\nmay happen.\n\n ------------[ cut here ]------------\n WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200\n CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)\n RIP: 0010:br_nf_local_in+0x168/0x200\n Call Trace:\n <TASK>\n nf_hook_slow+0x3e/0xf0\n br_pass_frame_up+0x103/0x180\n br_handle_frame_finish+0x2de/0x5b0\n br_nf_hook_thresh+0xc0/0x120\n br_nf_pre_routing_finish+0x168/0x3a0\n br_nf_pre_routing+0x237/0x5e0\n br_handle_frame+0x1ec/0x3c0\n __netif_receive_skb_core+0x225/0x1210\n __netif_receive_skb_one_core+0x37/0xa0\n netif_receive_skb+0x36/0x160\n tun_get_user+0xa54/0x10c0\n tun_chr_write_iter+0x65/0xb0\n vfs_write+0x305/0x410\n ksys_write+0x60/0xd0\n do_syscall_64+0xa4/0x260\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n ---[ end trace 0000000000000000 ]---\n\nTo solve the hash conflict, nf_ct_resolve_clash() try to merge the\nconntracks, and update skb->_nfct. However, br_nf_local_in() still use the\nold ct from local variable 'nfct' after confirm(), which leads to this\nwarning.\n\nIf confirm() does not insert the conntrack entry and return NF_DROP, the\nwarning may also occur. There is no need to reserve the WARN_ON_ONCE, just\nremove it."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: br_netfilter: no verificar el bit confirmado en br_nf_local_in() despu\u00e9s de confirmar\n\nCuando se env\u00eda un paquete de difusi\u00f3n a un dispositivo tap, que fue a\u00f1adido a un puente, se llama a br_nf_local_in() para confirmar el conntrack. Si otro conntrack con el mismo valor hash es a\u00f1adido a la tabla hash, lo cual puede ser provocado por un paquete normal a un dispositivo que no es un puente, la siguiente advertencia puede ocurrir.\n\n ------------[ cut here ]------------\n WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200\n CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)\n RIP: 0010:br_nf_local_in+0x168/0x200\n Call Trace:\n <TASK>\n nf_hook_slow+0x3e/0xf0\n br_pass_frame_up+0x103/0x180\n br_handle_frame_finish+0x2de/0x5b0\n br_nf_hook_thresh+0xc0/0x120\n br_nf_pre_routing_finish+0x168/0x3a0\n br_nf_pre_routing+0x237/0x5e0\n br_handle_frame+0x1ec/0x3c0\n __netif_receive_skb_core+0x225/0x1210\n __netif_receive_skb_one_core+0x37/0xa0\n netif_receive_skb+0x36/0x160\n tun_get_user+0xa54/0x10c0\n tun_chr_write_iter+0x65/0xb0\n vfs_write+0x305/0x410\n ksys_write+0x60/0xd0\n do_syscall_64+0xa4/0x260\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n ---[ end trace 0000000000000000 ]---\n\nPara resolver el conflicto de hash, nf_ct_resolve_clash() intenta fusionar los conntracks y actualizar skb->_nfct. Sin embargo, br_nf_local_in() todav\u00eda usa el ct antiguo de la variable local 'nfct' despu\u00e9s de confirm(), lo que lleva a esta advertencia.\n\nSi confirm() no inserta la entrada de conntrack y devuelve NF_DROP, la advertencia tambi\u00e9n puede ocurrir. No hay necesidad de reservar el WARN_ON_ONCE, simplemente qu\u00edtalo."}], "id": "CVE-2025-39894", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-39894", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:54:35.991421Z", "version": "2.0.3"}}]}, "published": "2025-10-01T08:15:31.987", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/479a54ab92087318514c82428a87af2d7af1a576"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/50db11e2bbb635e38e3dd096215580d6adb41fb0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a74abcf0f09f59daeecf7a3ba9c1d690808b0afe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c47ca77fee9071aa543bae592dd2a384f895c8b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ccbad4803225eafe0175d3cb19f0d8d73b504a94"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d00c8b0daf56012f69075e3377da67878c775e4c"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm", "id": "2400596", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2400596"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm\nWhen send a broadcast packet to a tap device, which was added to a bridge,\nbr_nf_local_in() is called to confirm the conntrack. If another conntrack\nwith the same hash value is added to the hash table, which can be\ntriggered by a normal packet to a non-bridge device, the below warning\nmay happen.\n------------[ cut here ]------------\nWARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200\nCPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)\nRIP: 0010:br_nf_local_in+0x168/0x200\nCall Trace:\n<TASK>\nnf_hook_slow+0x3e/0xf0\nbr_pass_frame_up+0x103/0x180\nbr_handle_frame_finish+0x2de/0x5b0\nbr_nf_hook_thresh+0xc0/0x120\nbr_nf_pre_routing_finish+0x168/0x3a0\nbr_nf_pre_routing+0x237/0x5e0\nbr_handle_frame+0x1ec/0x3c0\n__netif_receive_skb_core+0x225/0x1210\n__netif_receive_skb_one_core+0x37/0xa0\nnetif_receive_skb+0x36/0x160\ntun_get_user+0xa54/0x10c0\ntun_chr_write_iter+0x65/0xb0\nvfs_write+0x305/0x410\nksys_write+0x60/0xd0\ndo_syscall_64+0xa4/0x260\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\n</TASK>\n---[ end trace 0000000000000000 ]---\nTo solve the hash conflict, nf_ct_resolve_clash() try to merge the\nconntracks, and update skb->_nfct. However, br_nf_local_in() still use the\nold ct from local variable 'nfct' after confirm(), which leads to this\nwarning.\nIf confirm() does not insert the conntrack entry and return NF_DROP, the\nwarning may also occur. There is no need to reserve the WARN_ON_ONCE, just\nremove it."], "name": "CVE-2025-39894", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:rhivos:1", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat In-Vehicle Operating System 1"}], "public_date": "2025-10-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39894\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39894\nhttps://lore.kernel.org/linux-cve-announce/2025100115-CVE-2025-39894-f2dd@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-10-02T08:46:01.765445+00:00", "updated": "2025-10-02T08:46:01.765500+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}