{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-40337", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.186Z", "datePublished": "2025-12-09T04:09:53.808Z", "dateUpdated": "2026-08-05T12:09:43.747Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:09:43.747Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Correctly handle Rx checksum offload errors\n\nThe stmmac_rx function would previously set skb->ip_summed to\nCHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled\nand the packet was of a known IP ethertype.\n\nHowever, this logic failed to check if the hardware had actually\nreported a checksum error. The hardware status, indicating a header or\npayload checksum failure, was being ignored at this stage. This could\ncause corrupt packets to be passed up the network stack as valid.\n\nThis patch corrects the logic by checking the `csum_none` status flag,\nwhich is set when the hardware reports a checksum error. If this flag\nis set, skb->ip_summed is now correctly set to CHECKSUM_NONE,\nensuring the kernel's network stack will perform its own validation and\nproperly handle the corrupt packet." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "baseScore": 8.2, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The bug is triggered by a received Ethernet frame whose TCP/UDP checksum the DWMAC engine flags as bad; L4 checksums are end-to-end and are neither validated nor repaired by intermediate routers (NAT's incremental update preserves the incorrect value), so an attacker anywhere on the internet can deliver the triggering packet to a stmmac interface. No local access or adjacency is needed.\nAC:L - The attacker directly controls the trigger — they simply write an incorrect checksum field into the packet they send, and the driver deterministically marks it CHECKSUM_UNNECESSARY. There is no race, no memory-layout dependency, and RX COE is enabled by default on all stmmac cores that advertise it.\nPR:N - The vulnerable code is in the NAPI receive path, executed on every inbound frame before any socket, authentication, or authorization check. An unauthenticated remote sender needs no credentials or account on the target.\nUI:N - Packet reception and NAPI processing happen automatically; no action by any local user or administrator is required for the corrupt packet to be accepted and delivered up the stack.\nS:U - The mis-marked skb is consumed by the same host's network stack and its applications; no VM, IOMMU, or sandbox boundary is crossed, so the vulnerable and impacted components share one security authority.\nC:N - The flaw only mislabels a checksum result — there is no out-of-bounds read, no uninitialized memory exposure, and no kernel data is disclosed to the attacker. Packet lengths still come from independently validated IP header fields.\nI:H - The kernel affirmatively asserts \"checksum verified\" for packets the hardware reported as corrupt, so the transport-layer integrity protection for all received IP traffic on the interface is completely lost and corrupt or attacker-mangled payloads reach applications as authentic. It also lets an attacker inject TCP segments that checksum-validating IDS/IPS and passive monitors discard but the host accepts, a security-control bypass and stream-desynchronization attack.\nA:L - Accepted corrupt segments — flipped control flags, mangled payloads — cause spurious connection teardowns and application-level protocol failures, degrading service reliability. There is no kernel crash, hang, or deadlock in this path, so the availability loss is partial rather than total." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c" ], "versions": [ { "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "lessThan": "63fbe0e6413279d5ea5842e2423e351ded547683", "status": "affected", "versionType": "git" }, { "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "lessThan": "719fcdf29051f7471d5d433475af76219019d33d", "status": "affected", "versionType": "git" }, { "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "lessThan": "1aa319e0f12d2d761a31556b82a5852c98eb0bea", "status": "affected", "versionType": "git" }, { "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "lessThan": "ee0aace5f844ef59335148875d05bec8764e71e8", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c" ], "versions": [ { "version": "3.2", "status": "affected" }, { "version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.117", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.58", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.117" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.12.58" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.17.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.18" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/63fbe0e6413279d5ea5842e2423e351ded547683" }, { "url": "https://git.kernel.org/stable/c/719fcdf29051f7471d5d433475af76219019d33d" }, { "url": "https://git.kernel.org/stable/c/1aa319e0f12d2d761a31556b82a5852c98eb0bea" }, { "url": "https://git.kernel.org/stable/c/ee0aace5f844ef59335148875d05bec8764e71e8" } ], "title": "net: stmmac: Correctly handle Rx checksum offload errors", "x_generator": { "engine": "bippy-1.2.0" } } } }