Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-38572— ipv6: reject malicious packets in ipv6_gso_segment()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ipv6_gso_segment函数中未拒绝恶意数据包，可能导致传输头溢出。

CVSS 7.8 · High EPSS 0.19% · P8

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux d1da932ed4ecad2a14cbcc01ed589d617d0f0f09< 5dc60b2a00ed7629214ac0c48e43f40af2078703 affected
d1da932ed4ecad2a14cbcc01ed589d617d0f0f09< 3f638e0b28bde7c3354a0df938ab3a96739455d1 affected
d1da932ed4ecad2a14cbcc01ed589d617d0f0f09< 09ff062b89d8e48165247d677d1ca23d6d607e9b affected
d1da932ed4ecad2a14cbcc01ed589d617d0f0f09< de322cdf600fc9433845a9e944d1ca6b31cfb67e affected
d1da932ed4ecad2a14cbcc01ed589d617d0f0f09< ef05007b403dcc21e701cb1f30d4572ac0a9da20 affected
d1da932ed4ecad2a14cbcc01ed589d617d0f0f09< 5489e7fc6f8be3062f8cb7e49406de4bfd94db67 affected
d1da932ed4ecad2a14cbcc01ed589d617d0f0f09< 573b8250fc2554761db3bc2bbdbab23789d52d4e affected
d1da932ed4ecad2a14cbcc01ed589d617d0f0f09< ee851768e4b8371ce151fd446d24bf3ae2d18789 affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38572

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv6: reject malicious packets in ipv6_gso_segment()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: <TASK> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950 validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于ipv6_gso_segment函数中未拒绝恶意数据包，可能导致传输头溢出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux d1da932ed4ecad2a14cbcc01ed589d617d0f0f09 ~ 5dc60b2a00ed7629214ac0c48e43f40af2078703 -
Linux Linux 3.8 -

II. Public POCs for CVE-2025-38572

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38572

请登录查看更多情报信息。

Patches & Fixes for CVE-2025-38572 (2)

Same Patch Batch · Linux · 2025-08-19 · 59 CVEs total

CVE-2025-38561 9.8 CRITICAL ksmbd: fix Preauh_HashValue race condition
CVE-2025-38566 9.8 CRITICAL sunrpc: fix handling of server side tls alerts
CVE-2025-38560 9.3 CRITICAL x86/sev: Evict cache lines during SNP memory validation
CVE-2025-38601 8.8 HIGH wifi: ath11k: clear initialized flag for deinit-ed srng lists
CVE-2025-38600 8.8 HIGH wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()
CVE-2025-38599 8.8 HIGH wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx()
CVE-2025-38592 8.8 HIGH Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv
CVE-2025-38608 8.6 HIGH bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
CVE-2025-38574 8.6 HIGH pptp: ensure minimal skb length in pptp_xmit()
CVE-2025-38571 8.2 HIGH sunrpc: fix client side handling of tls alerts
CVE-2025-38595 7.8 HIGH xen: fix UAF in dmabuf_exp_from_pages()
CVE-2025-38598 7.8 HIGH drm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a0
CVE-2025-38607 7.8 HIGH bpf: handle jset (if a & b ...) as a jump in CFG computation
CVE-2025-38614 7.8 HIGH eventpoll: Fix semi-unbounded recursion
CVE-2025-38615 7.8 HIGH fs/ntfs3: cancle set bad inode after removing name fails
CVE-2025-38604 7.8 HIGH wifi: rtl818x: Kill URBs before clearing tx status queue
CVE-2025-38593 7.8 HIGH Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()'
CVE-2025-38586 7.8 HIGH bpf, arm64: Fix fp initialization for exception boundary
CVE-2025-38582 7.8 HIGH RDMA/hns: Fix double destruction of rsv_qp
CVE-2025-38580 7.8 HIGH ext4: fix inode use after free in ext4_end_io_rsv_work()

Showing top 20 of 59 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38572

No comments yet

Leave a comment