Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-39874— macsec: sync features on RTM_NEWLINK

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于macsec功能同步问题，可能导致设备锁定。

AI Predicted 6.5 Difficulty: Moderate EPSS 0.13% · P2

Possible ATT&CK Techniques 1 AI

T1499.002 · Service Exhaustion Flood

Affected Version Matrix 6

VendorProduct Version RangeStatus
Linux Linux 7e4d784f5810bba76c4593791028e13cce4af547< d7624629ccf47135c65fef0701fa0d9a115b87f3 affected
7e4d784f5810bba76c4593791028e13cce4af547< 0f82c3ba66c6b2e3cde0f255156a753b108ee9dc affected
6.15 affected
< 6.15 unaffected
6.16.8≤ 6.16.* unaffected
6.17≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-39874

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
macsec: sync features on RTM_NEWLINK
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: macsec: sync features on RTM_NEWLINK Syzkaller managed to lock the lower device via ETHTOOL_SFEATURES: netdev_lock include/linux/netdevice.h:2761 [inline] netdev_lock_ops include/net/netdev_lock.h:42 [inline] netdev_sync_lower_features net/core/dev.c:10649 [inline] __netdev_update_features+0xcb1/0x1be0 net/core/dev.c:10819 netdev_update_features+0x6d/0xe0 net/core/dev.c:10876 macsec_notify+0x2f5/0x660 drivers/net/macsec.c:4533 notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2267 [inline] call_netdevice_notifiers net/core/dev.c:2281 [inline] netdev_features_change+0x85/0xc0 net/core/dev.c:1570 __dev_ethtool net/ethtool/ioctl.c:3469 [inline] dev_ethtool+0x1536/0x19b0 net/ethtool/ioctl.c:3502 dev_ioctl+0x392/0x1150 net/core/dev_ioctl.c:759 It happens because lower features are out of sync with the upper: __dev_ethtool (real_dev) netdev_lock_ops(real_dev) ETHTOOL_SFEATURES __netdev_features_change netdev_sync_upper_features disable LRO on the lower if (old_features != dev->features) netdev_features_change fires NETDEV_FEAT_CHANGE macsec_notify NETDEV_FEAT_CHANGE netdev_update_features (for each macsec dev) netdev_sync_lower_features if (upper_features != lower_features) netdev_lock_ops(lower) # lower == real_dev stuck ... netdev_unlock_ops(real_dev) Per commit af5f54b0ef9e ("net: Lock lower level devices when updating features"), we elide the lock/unlock when the upper and lower features are synced. Makes sure the lower (real_dev) has proper features after the macsec link has been created. This makes sure we never hit the situation where we need to sync upper flags to the lower.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于macsec功能同步问题，可能导致设备锁定。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 7e4d784f5810bba76c4593791028e13cce4af547 ~ d7624629ccf47135c65fef0701fa0d9a115b87f3 -
Linux Linux 6.15 -

II. Public POCs for CVE-2025-39874

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-39874

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-09-23 · 21 CVEs total

CVE-2025-39880 9.8 CRITICAL libceph: fix invalid accesses to ceph_connection_v1_info
CVE-2025-39869 8.4 HIGH dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
CVE-2025-39882 8.4 HIGH drm/mediatek: fix potential OF node use-after-free
CVE-2025-39888 7.8 HIGH fuse: Block access to folio overlimit
CVE-2025-39872 7.8 HIGH hsr: hold rcu and dev lock for hsr_get_port_ndev
CVE-2025-39873 7.8 HIGH can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
CVE-2025-39868 7.8 HIGH erofs: fix runtime warning on truncate_folio_batch_exceptionals()
CVE-2025-39881 7.8 HIGH kernfs: Fix UAF in polling when open file is released
CVE-2025-39878 ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error
CVE-2025-39887 tracing/osnoise: Fix null-ptr-deref in bitmap_parselist()
CVE-2025-39885 ocfs2: fix recursive semaphore deadlock in fiemap call
CVE-2025-39886 bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
CVE-2025-39883 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
CVE-2025-39884 btrfs: fix subvolume deletion lockup caused by inodes xarray race
CVE-2025-39879 ceph: always call ceph_shift_unused_folios_left()
CVE-2025-39877 mm/damon/sysfs: fix use-after-free in state_show()
CVE-2025-39876 net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
CVE-2025-39875 igb: Fix NULL pointer dereference in ethtool loopback test
CVE-2025-39871 dmaengine: idxd: Remove improper idxd_free
CVE-2025-39870 dmaengine: idxd: Fix double free in idxd_setup_wqs()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-39874

No comments yet

Leave a comment