CVE-2025-39894

Q: What is the severity of CVE-2025-39894?

CVE-2025-39894 has a CVSS score of 5.5 (MEDIUM). A race condition vulnerability in the Linux kernel's netfilter bridge module (br_netfilter) can cause kernel warnings and potential denial-of-service when handling broadcast packets on bridged tap devices. This affects Linux systems using bridge networking with tap interfaces. The vulnerability triggers a WARN_ON_ONCE kernel warning that could lead to system instability.

5.5 MEDIUM

Denial of Service

📋 TL;DR

A race condition vulnerability in the Linux kernel's netfilter bridge module (br_netfilter) can cause kernel warnings and potential denial-of-service when handling broadcast packets on bridged tap devices. This affects Linux systems using bridge networking with tap interfaces. The vulnerability triggers a WARN_ON_ONCE kernel warning that could lead to system instability.

💻 Affected Systems

Products:

Linux Kernel

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution, but generally versions around 6.17.0-rc2 and earlier)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when using bridge networking with tap devices (common in virtualization/container setups). Standard bridge configurations without tap devices are not affected.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic or system crash due to repeated warnings, causing complete denial-of-service for affected network interfaces and potentially the entire system.

🟠

Likely Case

Kernel warning messages in system logs and temporary network disruption for bridged tap interfaces, with possible packet loss or connection issues.

🟢

If Mitigated

Minor performance impact with warning messages in logs but no service disruption if system handles warnings gracefully.

🌐 Internet-Facing: LOW - Requires specific bridge/tap configuration and local network access to trigger.

🏢 Internal Only: MEDIUM - Can be triggered by internal network traffic on systems with bridge/tap configurations, potentially affecting virtualization or container networking.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires sending specific network packets to trigger the race condition, but no public exploit code exists. The vulnerability is more likely to be triggered accidentally than maliciously.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 479a54ab92087318514c82428a87af2d7af1a576, 50db11e2bbb635e38e3dd096215580d6adb41fb0, a74abcf0f09f59daeecf7a3ba9c1d690808b0afe, c47ca77fee9071aa543bae592dd2a384f895c8b6, ccbad4803225eafe0175d3cb19f0d8d73b504a94

Vendor Advisory: https://git.kernel.org/stable/c/479a54ab92087318514c82428a87af2d7af1a576

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check your distribution's security advisories for patched kernel packages. 3. Reboot system after kernel update. 4. Verify kernel version after reboot.

🔧 Temporary Workarounds

Disable bridge netfilter

linux

Temporarily disable bridge netfilter if not required for your configuration

echo 0 > /proc/sys/net/bridge/bridge-nf-call-iptables
echo 0 > /proc/sys/net/bridge/bridge-nf-call-ip6tables
echo 0 > /proc/sys/net/bridge/bridge-nf-call-arptables

Avoid tap devices in bridges

linux

Remove tap interfaces from bridge configurations if possible

brctl delif <bridge_name> <tap_interface>

🧯 If You Can't Patch

Monitor system logs for kernel warnings related to br_nf_local_in
Consider moving critical services off systems using bridge/tap configurations

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if using bridge with tap devices. Look for 'WARNING: CPU' messages in dmesg related to br_nf_local_in

Check Version:

uname -r

Verify Fix Applied:

Check kernel version contains fix commits and monitor dmesg for absence of br_nf_local_in warnings during network traffic

📡 Detection & Monitoring

Log Indicators:

Kernel warning messages containing 'br_nf_local_in'
WARNING: CPU' messages in dmesg with call trace including br_nf_local_in

Network Indicators:

Increased packet loss on bridged interfaces
Network connectivity issues with tap devices

SIEM Query:

event_source="kernel" AND message CONTAINS "br_nf_local_in" AND severity="warning"

📊 Metadata

CVE ID: CVE-2025-39894

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.02% exploit probability (5.5th percentile)

Published: October 1, 2025

Last Updated: January 16, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable bridge netfilter

Avoid tap devices in bridges

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export