Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-39770— net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于GSO栈未正确禁用IPv6校验和卸载功能，可能导致设备不支持的操作和网络吞吐量下降。

CVSS 7.5 · High EPSS 0.38% · P30

Possible ATT&CK Techniques 1 AI

T1498 · Network Denial of Service

Affected Version Matrix 24

VendorProduct Version RangeStatus
Linux Linux a84978a9cda68f0afe3f01d476c68db21526baf1< a0478d7e888028f85fa7785ea838ce0ca09398e2 affected
c69bc67c1cb211aa390bea6e512bb01b1241fefb< 2156d9e9f2e483c8c3906c0ea57ea312c1424235 affected
04c20a9356f283da623903e81e7c6d5df7e4dc3c< 041e2f945f82fdbd6fff577b79c33469430297aa affected
04c20a9356f283da623903e81e7c6d5df7e4dc3c< 794ddbb7b63b6828c75967b9bcd43b086716e7a1 affected
04c20a9356f283da623903e81e7c6d5df7e4dc3c< 864e3396976ef41de6cc7bc366276bf4e084fff2 affected
bcefc3cd7f592a70fcbbbfd7ad1fbc69172ea78b affected
477b35d94a21530046fe91589960732fcf2b29ed affected
a27a5c40ee4cbe00294e2c76160de5f2589061ba affected
… +16 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-39770

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incorrectly requests checksum offload if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has a strict contract: it supports checksum offload only for plain TCP or UDP over IPv6 and explicitly does not support packets with extension headers. The current GSO logic violates this contract by failing to disable the feature for packets with extension headers, such as those used in GREoIPv6 tunnels. This violation results in the device being asked to perform an operation it cannot support, leading to a `skb_warn_bad_offload` warning and a collapse of network throughput. While device TSO/USO is correctly bypassed in favor of software GSO for these packets, the GSO stack must be explicitly told not to request checksum offload. Mask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4 in gso_features_check if the IPv6 header contains extension headers to compute checksum in software. The exception is a BIG TCP extension, which, as stated in commit 68e068cabd2c6c53 ("net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets"): "The feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump, and not transmitted by physical devices." kernel log output (truncated): WARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140 ... Call Trace: <TASK> skb_checksum_help+0x12a/0x1f0 validate_xmit_skb+0x1a3/0x2d0 validate_xmit_skb_list+0x4f/0x80 sch_direct_xmit+0x1a2/0x380 __dev_xmit_skb+0x242/0x670 __dev_queue_xmit+0x3fc/0x7f0 ip6_finish_output2+0x25e/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel] ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre] dev_hard_start_xmit+0x63/0x1c0 __dev_queue_xmit+0x6d0/0x7f0 ip6_finish_output2+0x214/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 inet6_csk_xmit+0xeb/0x150 __tcp_transmit_skb+0x555/0xa80 tcp_write_xmit+0x32a/0xe90 tcp_sendmsg_locked+0x437/0x1110 tcp_sendmsg+0x2f/0x50 ... skb linear: 00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e skb linear: 00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00 skb linear: 00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00 skb linear: 00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00 skb linear: 00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00 skb linear: 00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00 skb linear: 00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9 skb linear: 00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01 skb linear: 00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于GSO栈未正确禁用IPv6校验和卸载功能，可能导致设备不支持的操作和网络吞吐量下降。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a84978a9cda68f0afe3f01d476c68db21526baf1 ~ a0478d7e888028f85fa7785ea838ce0ca09398e2 -
Linux Linux 6.12 -

II. Public POCs for CVE-2025-39770

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-39770

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-09-11 · 54 CVEs total

CVE-2025-39758 9.8 CRITICAL RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages
CVE-2025-39761 8.8 HIGH wifi: ath12k: Decrement TID on RX peer frag setup error handling
CVE-2025-39750 8.8 HIGH wifi: ath12k: Correct tid cleanup when tid setup fails
CVE-2025-39790 8.4 HIGH bus: mhi: host: Detect events pointing to unexpected TREs
CVE-2025-39779 7.8 HIGH btrfs: subpage: keep TOWRITE tag until folio is cleaned
CVE-2025-39785 7.8 HIGH drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local
CVE-2025-39786 7.8 HIGH iio: adc: ad7173: fix channels index for syscalib_mode
CVE-2025-39740 7.8 HIGH drm/xe/migrate: prevent potential UAF
CVE-2025-39780 7.8 HIGH sched/ext: Fix invalid task state transitions on class switch
CVE-2025-39791 7.8 HIGH dm: dm-crypt: Do not partially accept write BIOs with zoned targets
CVE-2025-39787 7.8 HIGH soc: qcom: mdt_loader: Ensure we don't read past the ELF header
CVE-2025-39738 7.3 HIGH btrfs: do not allow relocation of partially dropped subvolumes
CVE-2025-39789 7.3 HIGH crypto: x86/aegis - Add missing error checks
CVE-2025-39776 7.0 HIGH mm/debug_vm_pgtable: clear page table entries at destroy_args()
CVE-2025-39771 regulator: pca9450: Use devm_register_sys_off_handler
CVE-2025-39782 jbd2: prevent softlockup in jbd2_log_do_checkpoint()
CVE-2025-39772 drm/hisilicon/hibmc: fix the hibmc loaded failed bug
CVE-2025-39784 PCI: Fix link speed calculation on retrain failure
CVE-2025-39768 net/mlx5: HWS, fix complex rules rehash error flow
CVE-2025-39766 net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit

Showing top 20 of 54 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-39770

No comments yet

Leave a comment