CVE-2025-39850 vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Addresses NPD Issues in VXLAN with CVEs-2025-39850 and CVE-2025-39851 Microsoft has published information regarding two vulnerabilities in the VXLAN protocol, identified as CVE-2025-39850 and CVE-2025-39851. Both vulnerabilities, published on September 19, 2025, involve null pointer dereference (NPD) issues when using nexthop objects in specific functions. Affected systems may experience instability or crashes due to these vulnerabilities. 2 sources 41