CVE-2025-39894 (GCVE-0-2025-39894)

Vulnerability from cvelistv5 – Published: 2025-10-01 07:42 – Updated: 2026-08-05 12:05
VLAI
Title
netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm When send a broadcast packet to a tap device, which was added to a bridge, br_nf_local_in() is called to confirm the conntrack. If another conntrack with the same hash value is added to the hash table, which can be triggered by a normal packet to a non-bridge device, the below warning may happen. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200 CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary) RIP: 0010:br_nf_local_in+0x168/0x200 Call Trace: <TASK> nf_hook_slow+0x3e/0xf0 br_pass_frame_up+0x103/0x180 br_handle_frame_finish+0x2de/0x5b0 br_nf_hook_thresh+0xc0/0x120 br_nf_pre_routing_finish+0x168/0x3a0 br_nf_pre_routing+0x237/0x5e0 br_handle_frame+0x1ec/0x3c0 __netif_receive_skb_core+0x225/0x1210 __netif_receive_skb_one_core+0x37/0xa0 netif_receive_skb+0x36/0x160 tun_get_user+0xa54/0x10c0 tun_chr_write_iter+0x65/0xb0 vfs_write+0x305/0x410 ksys_write+0x60/0xd0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> ---[ end trace 0000000000000000 ]--- To solve the hash conflict, nf_ct_resolve_clash() try to merge the conntracks, and update skb->_nfct. However, br_nf_local_in() still use the old ct from local variable 'nfct' after confirm(), which leads to this warning. If confirm() does not insert the conntrack entry and return NF_DROP, the warning may also occur. There is no need to reserve the WARN_ON_ONCE, just remove it.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 7c3f28599652acf431a2211168de4a583f30b6d5 , < d00c8b0daf56012f69075e3377da67878c775e4c (git)
Affected: 2b1414d5e94e477edff1d2c79030f1d742625ea0 , < ccbad4803225eafe0175d3cb19f0d8d73b504a94 (git)
Affected: 80cd0487f630b5382734997c3e5e3003a77db315 , < 50db11e2bbb635e38e3dd096215580d6adb41fb0 (git)
Affected: 62e7151ae3eb465e0ab52a20c941ff33bb6332e9 , < c47ca77fee9071aa543bae592dd2a384f895c8b6 (git)
Affected: 62e7151ae3eb465e0ab52a20c941ff33bb6332e9 , < a74abcf0f09f59daeecf7a3ba9c1d690808b0afe (git)
Affected: 62e7151ae3eb465e0ab52a20c941ff33bb6332e9 , < 479a54ab92087318514c82428a87af2d7af1a576 (git)
Affected: cb734975b0ffa688ff6cc0eed463865bf07b6c01 (git)
Affected: 5.15.151 , < 5.15.192 (semver)
Affected: 6.1.81 , < 6.1.151 (semver)
Affected: 6.6.21 , < 6.6.105 (semver)
Affected: 6.7.9 , < 6.8 (semver)
Create a notification for this product.
Linux Linux Affected: 6.8
Unaffected: 0 , < 6.8 (semver)
Unaffected: 5.15.192 , ≤ 5.15.* (semver)
Unaffected: 6.1.151 , ≤ 6.1.* (semver)
Unaffected: 6.6.105 , ≤ 6.6.* (semver)
Unaffected: 6.12.46 , ≤ 6.12.* (semver)
Unaffected: 6.16.6 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T17:44:28.733Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_netfilter_hooks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d00c8b0daf56012f69075e3377da67878c775e4c",
              "status": "affected",
              "version": "7c3f28599652acf431a2211168de4a583f30b6d5",
              "versionType": "git"
            },
            {
              "lessThan": "ccbad4803225eafe0175d3cb19f0d8d73b504a94",
              "status": "affected",
              "version": "2b1414d5e94e477edff1d2c79030f1d742625ea0",
              "versionType": "git"
            },
            {
              "lessThan": "50db11e2bbb635e38e3dd096215580d6adb41fb0",
              "status": "affected",
              "version": "80cd0487f630b5382734997c3e5e3003a77db315",
              "versionType": "git"
            },
            {
              "lessThan": "c47ca77fee9071aa543bae592dd2a384f895c8b6",
              "status": "affected",
              "version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9",
              "versionType": "git"
            },
            {
              "lessThan": "a74abcf0f09f59daeecf7a3ba9c1d690808b0afe",
              "status": "affected",
              "version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9",
              "versionType": "git"
            },
            {
              "lessThan": "479a54ab92087318514c82428a87af2d7af1a576",
              "status": "affected",
              "version": "62e7151ae3eb465e0ab52a20c941ff33bb6332e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "cb734975b0ffa688ff6cc0eed463865bf07b6c01",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.192",
              "status": "affected",
              "version": "5.15.151",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.151",
              "status": "affected",
              "version": "6.1.81",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.105",
              "status": "affected",
              "version": "6.6.21",
              "versionType": "semver"
            },
            {
              "lessThan": "6.8",
              "status": "affected",
              "version": "6.7.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/br_netfilter_hooks.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.192",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.192",
                  "versionStartIncluding": "5.15.151",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.151",
                  "versionStartIncluding": "6.1.81",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.105",
                  "versionStartIncluding": "6.6.21",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.46",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.6",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.7.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm\n\nWhen send a broadcast packet to a tap device, which was added to a bridge,\nbr_nf_local_in() is called to confirm the conntrack. If another conntrack\nwith the same hash value is added to the hash table, which can be\ntriggered by a normal packet to a non-bridge device, the below warning\nmay happen.\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200\n  CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)\n  RIP: 0010:br_nf_local_in+0x168/0x200\n  Call Trace:\n   \u003cTASK\u003e\n   nf_hook_slow+0x3e/0xf0\n   br_pass_frame_up+0x103/0x180\n   br_handle_frame_finish+0x2de/0x5b0\n   br_nf_hook_thresh+0xc0/0x120\n   br_nf_pre_routing_finish+0x168/0x3a0\n   br_nf_pre_routing+0x237/0x5e0\n   br_handle_frame+0x1ec/0x3c0\n   __netif_receive_skb_core+0x225/0x1210\n   __netif_receive_skb_one_core+0x37/0xa0\n   netif_receive_skb+0x36/0x160\n   tun_get_user+0xa54/0x10c0\n   tun_chr_write_iter+0x65/0xb0\n   vfs_write+0x305/0x410\n   ksys_write+0x60/0xd0\n   do_syscall_64+0xa4/0x260\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n   \u003c/TASK\u003e\n  ---[ end trace 0000000000000000 ]---\n\nTo solve the hash conflict, nf_ct_resolve_clash() try to merge the\nconntracks, and update skb-\u003e_nfct. However, br_nf_local_in() still use the\nold ct from local variable \u0027nfct\u0027 after confirm(), which leads to this\nwarning.\n\nIf confirm() does not insert the conntrack entry and return NF_DROP, the\nwarning may also occur. There is no need to reserve the WARN_ON_ONCE, just\nremove it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The trigger is a broadcast/multicast IP frame arriving on a bridge port and being locally delivered via br_pass_frame_up() \u2192 NF_BR_LOCAL_IN, requiring no host access at all; on the very common overlay deployments (VXLAN/GRE port enslaved to a Linux bridge in Docker overlay, k8s CNI, OpenStack) those inner broadcast frames originate from a routed, remote VTEP, making the vulnerable code reachable across layer 3.\nAC:L - The attacker drives both sides of the clash by flooding duplicate same-tuple broadcast datagrams, which the bridge itself fans out concurrently (flood to N ports plus local receive, plus a copy to a non-bridge device as noted in the commit), so two unconfirmed conntracks with an identical tuple reach __nf_conntrack_confirm() in parallel. The required br_netfilter+conntrack+bridge configuration is the default on container and virtualization hosts, not a rare option.\nPR:N - No credentials or capabilities on the target are needed \u2014 the attacker only has to get an IP broadcast/multicast frame onto a segment bridged by the victim, which is unauthenticated packet delivery.\nUI:N - No victim action is required; the bridge processes the received frames automatically in softirq context.\nS:U - The stale conntrack read and the WARNING both occur in the host kernel\u0027s own netfilter/bridge context, with no crossing of a VM, IOMMU, or sandbox boundary.\nC:N - The stale read is a single unsigned long from a SLAB_TYPESAFE_BY_RCU nf_conn object and its value is consumed only by the WARN condition \u2014 it is never returned to the attacker, and the remote attacker has no channel to read the resulting dmesg splat.\nI:N - No write occurs on the stale pointer; confirm() has already repointed skb-\u003e_nfct at the surviving conntrack with a valid reference, so no kernel memory is modified and no control flow is influenced.\nA:H - The bug fires a kernel WARNING from a remotely reachable softirq path, which taints the kernel and causes an immediate panic on the many hardened, Android, ChromeOS, and cloud/CI deployments that run with panic_on_warn=1, yielding a full denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:56.359Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d00c8b0daf56012f69075e3377da67878c775e4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccbad4803225eafe0175d3cb19f0d8d73b504a94"
        },
        {
          "url": "https://git.kernel.org/stable/c/50db11e2bbb635e38e3dd096215580d6adb41fb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c47ca77fee9071aa543bae592dd2a384f895c8b6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a74abcf0f09f59daeecf7a3ba9c1d690808b0afe"
        },
        {
          "url": "https://git.kernel.org/stable/c/479a54ab92087318514c82428a87af2d7af1a576"
        }
      ],
      "title": "netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39894",
    "datePublished": "2025-10-01T07:42:43.126Z",
    "dateReserved": "2025-04-16T07:20:57.145Z",
    "dateUpdated": "2026-08-05T12:05:56.359Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39894",
      "date": "2026-08-05",
      "epss": "0.00302",
      "percentile": "0.22498"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-24T14:41:23.000Z",
      "cve": "CVE-2025-39894",
      "id": "msrc_CVE-2025-39894",
      "initial_release_date": "2025-10-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-39894.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-39894\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-01T08:15:31.987\",\"lastModified\":\"2026-07-30T06:23:54.247\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm\\n\\nWhen send a broadcast packet to a tap device, which was added to a bridge,\\nbr_nf_local_in() is called to confirm the conntrack. If another conntrack\\nwith the same hash value is added to the hash table, which can be\\ntriggered by a normal packet to a non-bridge device, the below warning\\nmay happen.\\n\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200\\n  CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)\\n  RIP: 0010:br_nf_local_in+0x168/0x200\\n  Call Trace:\\n   \u003cTASK\u003e\\n   nf_hook_slow+0x3e/0xf0\\n   br_pass_frame_up+0x103/0x180\\n   br_handle_frame_finish+0x2de/0x5b0\\n   br_nf_hook_thresh+0xc0/0x120\\n   br_nf_pre_routing_finish+0x168/0x3a0\\n   br_nf_pre_routing+0x237/0x5e0\\n   br_handle_frame+0x1ec/0x3c0\\n   __netif_receive_skb_core+0x225/0x1210\\n   __netif_receive_skb_one_core+0x37/0xa0\\n   netif_receive_skb+0x36/0x160\\n   tun_get_user+0xa54/0x10c0\\n   tun_chr_write_iter+0x65/0xb0\\n   vfs_write+0x305/0x410\\n   ksys_write+0x60/0xd0\\n   do_syscall_64+0xa4/0x260\\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n   \u003c/TASK\u003e\\n  ---[ end trace 0000000000000000 ]---\\n\\nTo solve the hash conflict, nf_ct_resolve_clash() try to merge the\\nconntracks, and update skb-\u003e_nfct. However, br_nf_local_in() still use the\\nold ct from local variable \u0027nfct\u0027 after confirm(), which leads to this\\nwarning.\\n\\nIf confirm() does not insert the conntrack entry and return NF_DROP, the\\nwarning may also occur. There is no need to reserve the WARN_ON_ONCE, just\\nremove it.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bridge/br_netfilter_hooks.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"7c3f28599652acf431a2211168de4a583f30b6d5\",\"lessThan\":\"d00c8b0daf56012f69075e3377da67878c775e4c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b1414d5e94e477edff1d2c79030f1d742625ea0\",\"lessThan\":\"ccbad4803225eafe0175d3cb19f0d8d73b504a94\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"80cd0487f630b5382734997c3e5e3003a77db315\",\"lessThan\":\"50db11e2bbb635e38e3dd096215580d6adb41fb0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"62e7151ae3eb465e0ab52a20c941ff33bb6332e9\",\"lessThan\":\"c47ca77fee9071aa543bae592dd2a384f895c8b6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"62e7151ae3eb465e0ab52a20c941ff33bb6332e9\",\"lessThan\":\"a74abcf0f09f59daeecf7a3ba9c1d690808b0afe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"62e7151ae3eb465e0ab52a20c941ff33bb6332e9\",\"lessThan\":\"479a54ab92087318514c82428a87af2d7af1a576\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cb734975b0ffa688ff6cc0eed463865bf07b6c01\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.151\",\"lessThan\":\"5.15.192\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.81\",\"lessThan\":\"6.1.151\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.21\",\"lessThan\":\"6.6.105\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.7.9\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bridge/br_netfilter_hooks.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.192\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.151\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.105\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.46\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.16.6\",\"lessThanOrEqual\":\"6.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.151\",\"versionEndExcluding\":\"5.15.192\",\"matchCriteriaId\":\"EAEDCA1A-2745-4005-85AE-39E44436B5D2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.81\",\"versionEndExcluding\":\"6.1.151\",\"matchCriteriaId\":\"CB3C782A-F7CE-4C5F-AA7F-B5FF3DCDA1AF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.21\",\"versionEndExcluding\":\"6.6.105\",\"matchCriteriaId\":\"224C8BB6-3C4A-4887-98F0-6563C9376380\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7.9\",\"versionEndExcluding\":\"6.8\",\"matchCriteriaId\":\"739125EE-99C1-42E1-B870-04FD5010BA66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8.1\",\"versionEndExcluding\":\"6.12.46\",\"matchCriteriaId\":\"E12DFF9A-7ACE-4914-8CB1-28DB75F1E42B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.16.6\",\"matchCriteriaId\":\"548F104C-0F08-438B-9C97-64C903F0C678\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"41E47F32-BA80-4333-96FD-4D25082B0FDD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9B8A5CE-6D20-4C36-AC01-ACA4B70003A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"327D22EF-390B-454C-BD31-2ED23C998A1C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C730CD9A-D969-4A8E-9522-162AAF7C0EE9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"39982C4B-716E-4B2F-8196-FA301F47807D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"340BEEA9-D70D-4290-B502-FBB1032353B1\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/479a54ab92087318514c82428a87af2d7af1a576\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/50db11e2bbb635e38e3dd096215580d6adb41fb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a74abcf0f09f59daeecf7a3ba9c1d690808b0afe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c47ca77fee9071aa543bae592dd2a384f895c8b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ccbad4803225eafe0175d3cb19f0d8d73b504a94\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d00c8b0daf56012f69075e3377da67878c775e4c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T08:53:25+00:00",
      "cve": "CVE-2025-39894",
      "id": "CVE-2025-39894",
      "initial_release_date": "2025-10-01T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39894.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.