CVE-2025-40337 (GCVE-0-2025-40337)

Vulnerability from cvelistv5 – Published: 2025-12-09 04:09 – Updated: 2026-08-05 12:09
VLAI
Title
net: stmmac: Correctly handle Rx checksum offload errors
Summary
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Correctly handle Rx checksum offload errors The stmmac_rx function would previously set skb->ip_summed to CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled and the packet was of a known IP ethertype. However, this logic failed to check if the hardware had actually reported a checksum error. The hardware status, indicating a header or payload checksum failure, was being ignored at this stage. This could cause corrupt packets to be passed up the network stack as valid. This patch corrects the logic by checking the `csum_none` status flag, which is set when the hardware reports a checksum error. If this flag is set, skb->ip_summed is now correctly set to CHECKSUM_NONE, ensuring the kernel's network stack will perform its own validation and properly handle the corrupt packet.
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0 , < 63fbe0e6413279d5ea5842e2423e351ded547683 (git)
Affected: 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0 , < 719fcdf29051f7471d5d433475af76219019d33d (git)
Affected: 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0 , < 1aa319e0f12d2d761a31556b82a5852c98eb0bea (git)
Affected: 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0 , < ee0aace5f844ef59335148875d05bec8764e71e8 (git)
Create a notification for this product.
Linux Linux Affected: 3.2
Unaffected: 0 , < 3.2 (semver)
Unaffected: 6.6.117 , ≤ 6.6.* (semver)
Unaffected: 6.12.58 , ≤ 6.12.* (semver)
Unaffected: 6.17.8 , ≤ 6.17.* (semver)
Unaffected: 6.18 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "63fbe0e6413279d5ea5842e2423e351ded547683",
              "status": "affected",
              "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0",
              "versionType": "git"
            },
            {
              "lessThan": "719fcdf29051f7471d5d433475af76219019d33d",
              "status": "affected",
              "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0",
              "versionType": "git"
            },
            {
              "lessThan": "1aa319e0f12d2d761a31556b82a5852c98eb0bea",
              "status": "affected",
              "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0",
              "versionType": "git"
            },
            {
              "lessThan": "ee0aace5f844ef59335148875d05bec8764e71e8",
              "status": "affected",
              "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.58",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17.8",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Correctly handle Rx checksum offload errors\n\nThe stmmac_rx function would previously set skb-\u003eip_summed to\nCHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled\nand the packet was of a known IP ethertype.\n\nHowever, this logic failed to check if the hardware had actually\nreported a checksum error. The hardware status, indicating a header or\npayload checksum failure, was being ignored at this stage. This could\ncause corrupt packets to be passed up the network stack as valid.\n\nThis patch corrects the logic by checking the `csum_none` status flag,\nwhich is set when the hardware reports a checksum error. If this flag\nis set, skb-\u003eip_summed is now correctly set to CHECKSUM_NONE,\nensuring the kernel\u0027s network stack will perform its own validation and\nproperly handle the corrupt packet."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered by a received Ethernet frame whose TCP/UDP checksum the DWMAC engine flags as bad; L4 checksums are end-to-end and are neither validated nor repaired by intermediate routers (NAT\u0027s incremental update preserves the incorrect value), so an attacker anywhere on the internet can deliver the triggering packet to a stmmac interface. No local access or adjacency is needed.\nAC:L - The attacker directly controls the trigger \u2014 they simply write an incorrect checksum field into the packet they send, and the driver deterministically marks it CHECKSUM_UNNECESSARY. There is no race, no memory-layout dependency, and RX COE is enabled by default on all stmmac cores that advertise it.\nPR:N - The vulnerable code is in the NAPI receive path, executed on every inbound frame before any socket, authentication, or authorization check. An unauthenticated remote sender needs no credentials or account on the target.\nUI:N - Packet reception and NAPI processing happen automatically; no action by any local user or administrator is required for the corrupt packet to be accepted and delivered up the stack.\nS:U - The mis-marked skb is consumed by the same host\u0027s network stack and its applications; no VM, IOMMU, or sandbox boundary is crossed, so the vulnerable and impacted components share one security authority.\nC:N - The flaw only mislabels a checksum result \u2014 there is no out-of-bounds read, no uninitialized memory exposure, and no kernel data is disclosed to the attacker. Packet lengths still come from independently validated IP header fields.\nI:H - The kernel affirmatively asserts \"checksum verified\" for packets the hardware reported as corrupt, so the transport-layer integrity protection for all received IP traffic on the interface is completely lost and corrupt or attacker-mangled payloads reach applications as authentic. It also lets an attacker inject TCP segments that checksum-validating IDS/IPS and passive monitors discard but the host accepts, a security-control bypass and stream-desynchronization attack.\nA:L - Accepted corrupt segments \u2014 flipped control flags, mangled payloads \u2014 cause spurious connection teardowns and application-level protocol failures, degrading service reliability. There is no kernel crash, hang, or deadlock in this path, so the availability loss is partial rather than total."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:09:43.747Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/63fbe0e6413279d5ea5842e2423e351ded547683"
        },
        {
          "url": "https://git.kernel.org/stable/c/719fcdf29051f7471d5d433475af76219019d33d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1aa319e0f12d2d761a31556b82a5852c98eb0bea"
        },
        {
          "url": "https://git.kernel.org/stable/c/ee0aace5f844ef59335148875d05bec8764e71e8"
        }
      ],
      "title": "net: stmmac: Correctly handle Rx checksum offload errors",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-40337",
    "datePublished": "2025-12-09T04:09:53.808Z",
    "dateReserved": "2025-04-16T07:20:57.186Z",
    "dateUpdated": "2026-08-05T12:09:43.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-40337",
      "date": "2026-08-05",
      "epss": "0.0043",
      "percentile": "0.35343"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-40337\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-09T16:17:43.923\",\"lastModified\":\"2026-07-30T06:24:30.197\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: stmmac: Correctly handle Rx checksum offload errors\\n\\nThe stmmac_rx function would previously set skb-\u003eip_summed to\\nCHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled\\nand the packet was of a known IP ethertype.\\n\\nHowever, this logic failed to check if the hardware had actually\\nreported a checksum error. The hardware status, indicating a header or\\npayload checksum failure, was being ignored at this stage. This could\\ncause corrupt packets to be passed up the network stack as valid.\\n\\nThis patch corrects the logic by checking the `csum_none` status flag,\\nwhich is set when the hardware reports a checksum error. If this flag\\nis set, skb-\u003eip_summed is now correctly set to CHECKSUM_NONE,\\nensuring the kernel\u0027s network stack will perform its own validation and\\nproperly handle the corrupt packet.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3c20f72f9108b2fcf30ec63d8a4203736c01ccd0\",\"lessThan\":\"63fbe0e6413279d5ea5842e2423e351ded547683\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c20f72f9108b2fcf30ec63d8a4203736c01ccd0\",\"lessThan\":\"719fcdf29051f7471d5d433475af76219019d33d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c20f72f9108b2fcf30ec63d8a4203736c01ccd0\",\"lessThan\":\"1aa319e0f12d2d761a31556b82a5852c98eb0bea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3c20f72f9108b2fcf30ec63d8a4203736c01ccd0\",\"lessThan\":\"ee0aace5f844ef59335148875d05bec8764e71e8\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/stmicro/stmmac/stmmac_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.117\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.58\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.17.8\",\"lessThanOrEqual\":\"6.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1aa319e0f12d2d761a31556b82a5852c98eb0bea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/63fbe0e6413279d5ea5842e2423e351ded547683\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/719fcdf29051f7471d5d433475af76219019d33d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ee0aace5f844ef59335148875d05bec8764e71e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:34:37+00:00",
      "cve": "CVE-2025-40337",
      "id": "CVE-2025-40337",
      "initial_release_date": "2025-12-09T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: stmmac: Correctly handle Rx checksum offload errors",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-40337.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T00:31:06Z",
      "cve": "CVE-2025-40337",
      "id": "CVE-2025-40337",
      "initial_release_date": "2025-12-10T00:26:32Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "724",
      "product_status:recommended": "344",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-40337",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-40337.json",
      "version": "41"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.