CVE-2025-39702

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39702", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.115Z", "datePublished": "2025-09-05T17:21:08.674Z", "dateUpdated": "2026-10-15T22:02:30.641Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:04:40.981Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant time.\nUse the appropriate helper function for this."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable comparison sits in the IPv6 Segment Routing Header receive path (`ipv6_srh_rcv()` and the seg6_local behaviors), processing routed IPv6 packets from any remote source. SRv6 packets are not link-local, so an attacker anywhere on the network can drive the oracle.\nAC:L - The attacker controls both sides of the measurement \u2014 the candidate MAC bytes and an unlimited, self-paced stream of probe packets \u2014 so the byte-at-a-time `memcmp` leak can be amplified by repetition and statistical averaging, including jitter-immune concurrent-probe techniques. No condition depends on state the attacker cannot influence.\nPR:N - The HMAC validation is itself the authentication gate for the SR domain; nothing on the path from packet receive to `seg6_hmac_validate_skb()` checks any credential or capability. The attacker is an unauthenticated off-path/off-domain sender.\nUI:N - Exploitation requires only sending crafted SRv6 packets to the target; no victim action is involved.\nS:U - The forged authentication is consumed and acted upon within the same kernel networking authority that performs the check; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Forging the SRH MAC bypasses the SR-domain trust boundary, letting the attacker source-route packets to otherwise unreachable internal nodes and, via End.DT4/DT6/DX behaviors, into isolated tenant VRFs and L2 domains, with the return path steerable back to the attacker. The timing oracle additionally recovers secret-key-derived MAC values.\nI:H - A recovered MAC makes the kernel accept attacker-crafted segment lists as authentic, allowing arbitrary rewriting of forwarding paths and injection of spoofed traffic into tenant networks and internal L2 bridges \u2014 a complete authentication bypass of the SRv6 integrity mechanism.\nA:H - Forged segment lists can be built to loop packets repeatedly between SR nodes and to blackhole or misdirect legitimate traffic, disrupting forwarding for the node and the SR domain it serves."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/seg6_hmac.c"], "versions": [{"version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "ff55a452d56490047f5233cc48c5d933f8586884", "status": "affected", "versionType": "git"}, {"version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0", "status": "affected", "versionType": "git"}, {"version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "86b6d34717fe0570afce07ee79b8eeb40341f831", "status": "affected", "versionType": "git"}, {"version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3", "status": "affected", "versionType": "git"}, {"version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "b3967c493799e63f648e9c7b6cb063aa2aed04e7", "status": "affected", "versionType": "git"}, {"version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "f7878d47560d61e3f370aca3cebb8f42a55b990a", "status": "affected", "versionType": "git"}, {"version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "a458b2902115b26a25d67393b12ddd57d1216aaa", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/seg6_hmac.c"], "versions": [{"version": "4.10", "status": "affected"}, {"version": "0", "lessThan": "4.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.249", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.190", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.149", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.103", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.44", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.4", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.10.249"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "5.15.190"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.1.149"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.6.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.12.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.16.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ff55a452d56490047f5233cc48c5d933f8586884"}, {"url": "https://git.kernel.org/stable/c/3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0"}, {"url": "https://git.kernel.org/stable/c/86b6d34717fe0570afce07ee79b8eeb40341f831"}, {"url": "https://git.kernel.org/stable/c/3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3"}, {"url": "https://git.kernel.org/stable/c/b3967c493799e63f648e9c7b6cb063aa2aed04e7"}, {"url": "https://git.kernel.org/stable/c/f7878d47560d61e3f370aca3cebb8f42a55b990a"}, {"url": "https://git.kernel.org/stable/c/a458b2902115b26a25d67393b12ddd57d1216aaa"}], "title": "ipv6: sr: Fix MAC comparison to be constant-time", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:42:30.669Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:06:24.521Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39702", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:53:32.850738Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:30.641Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:42:30.669Z"}}, {"affected": [{"vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [{"status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:06:24.521Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-39702", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:53:32.850738Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:53:33.898Z"}}], "cna": {"title": "ipv6: sr: Fix MAC comparison to be constant-time", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable comparison sits in the IPv6 Segment Routing Header receive path (`ipv6_srh_rcv()` and the seg6_local behaviors), processing routed IPv6 packets from any remote source. SRv6 packets are not link-local, so an attacker anywhere on the network can drive the oracle.\nAC:L - The attacker controls both sides of the measurement \u2014 the candidate MAC bytes and an unlimited, self-paced stream of probe packets \u2014 so the byte-at-a-time `memcmp` leak can be amplified by repetition and statistical averaging, including jitter-immune concurrent-probe techniques. No condition depends on state the attacker cannot influence.\nPR:N - The HMAC validation is itself the authentication gate for the SR domain; nothing on the path from packet receive to `seg6_hmac_validate_skb()` checks any credential or capability. The attacker is an unauthenticated off-path/off-domain sender.\nUI:N - Exploitation requires only sending crafted SRv6 packets to the target; no victim action is involved.\nS:U - The forged authentication is consumed and acted upon within the same kernel networking authority that performs the check; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Forging the SRH MAC bypasses the SR-domain trust boundary, letting the attacker source-route packets to otherwise unreachable internal nodes and, via End.DT4/DT6/DX behaviors, into isolated tenant VRFs and L2 domains, with the return path steerable back to the attacker. The timing oracle additionally recovers secret-key-derived MAC values.\nI:H - A recovered MAC makes the kernel accept attacker-crafted segment lists as authentic, allowing arbitrary rewriting of forwarding paths and injection of spoofed traffic into tenant networks and internal L2 bridges \u2014 a complete authentication bypass of the SRv6 integrity mechanism.\nA:H - Forged segment lists can be built to loop packets repeatedly between SR nodes and to blackhole or misdirect legitimate traffic, disrupting forwarding for the node and the SR domain it serves."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "ff55a452d56490047f5233cc48c5d933f8586884", "versionType": "git"}, {"status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0", "versionType": "git"}, {"status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "86b6d34717fe0570afce07ee79b8eeb40341f831", "versionType": "git"}, {"status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3", "versionType": "git"}, {"status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "b3967c493799e63f648e9c7b6cb063aa2aed04e7", "versionType": "git"}, {"status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "f7878d47560d61e3f370aca3cebb8f42a55b990a", "versionType": "git"}, {"status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "lessThan": "a458b2902115b26a25d67393b12ddd57d1216aaa", "versionType": "git"}], "programFiles": ["net/ipv6/seg6_hmac.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"status": "unaffected", "version": "0", "lessThan": "4.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.249", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.190", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.149", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.103", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.44", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.16.4", "versionType": "semver", "lessThanOrEqual": "6.16.*"}, {"status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv6/seg6_hmac.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ff55a452d56490047f5233cc48c5d933f8586884"}, {"url": "https://git.kernel.org/stable/c/3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0"}, {"url": "https://git.kernel.org/stable/c/86b6d34717fe0570afce07ee79b8eeb40341f831"}, {"url": "https://git.kernel.org/stable/c/3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3"}, {"url": "https://git.kernel.org/stable/c/b3967c493799e63f648e9c7b6cb063aa2aed04e7"}, {"url": "https://git.kernel.org/stable/c/f7878d47560d61e3f370aca3cebb8f42a55b990a"}, {"url": "https://git.kernel.org/stable/c/a458b2902115b26a25d67393b12ddd57d1216aaa"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant time.\nUse the appropriate helper function for this."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.249", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.190", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.149", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.103", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.44", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.16.4", "versionStartIncluding": "4.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17", "versionStartIncluding": "4.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:04:40.981Z"}}}, "cveMetadata": {"cveId": "CVE-2025-39702", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:30.641Z", "dateReserved": "2025-04-16T07:20:57.115Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-09-05T17:21:08.674Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv6/seg6_hmac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ff55a452d56490047f5233cc48c5d933f8586884", "status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "versionType": "git"}, {"lessThan": "3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0", "status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "versionType": "git"}, {"lessThan": "86b6d34717fe0570afce07ee79b8eeb40341f831", "status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "versionType": "git"}, {"lessThan": "3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3", "status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "versionType": "git"}, {"lessThan": "b3967c493799e63f648e9c7b6cb063aa2aed04e7", "status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "versionType": "git"}, {"lessThan": "f7878d47560d61e3f370aca3cebb8f42a55b990a", "status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "versionType": "git"}, {"lessThan": "a458b2902115b26a25d67393b12ddd57d1216aaa", "status": "affected", "version": "bf355b8d2c30a289232042cacc1cfaea4923936c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv6/seg6_hmac.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.10"}, {"lessThan": "4.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.249", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.190", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.149", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.103", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.44", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC CN 4100", "vendor": "Siemens", "versions": [{"lessThan": "V5.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "22CBC71E-5CD6-4C8C-82BB-4463FCD5C515", "versionEndExcluding": "5.15.190", "versionStartIncluding": "4.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "FDBE8280-8983-4D2D-943D-2E6D0104E2D8", "versionEndExcluding": "6.1.149", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F2293654-7169-49B5-8D0D-EE51EF8B8E48", "versionEndExcluding": "6.6.103", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "12351F24-1133-4775-960C-F2B47E81298B", "versionEndExcluding": "6.12.44", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AFC28995-B8C3-4B68-8CB6-78E792B6629D", "versionEndExcluding": "6.16.4", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*", "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*", "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*", "matchCriteriaId": "FA6FEEC2-9F11-4643-8827-749718254FED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: sr: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant time.\nUse the appropriate helper function for this."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nipv6: sr: Correcci\u00f3n de la comparaci\u00f3n de MAC para que sea de tiempo constante\n\nPara prevenir ataques de temporizaci\u00f3n, los MAC deben compararse en tiempo constante.\nUtilice la funci\u00f3n auxiliar adecuada para ello."}], "id": "CVE-2025-39702", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-39702", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:53:32.850738Z", "version": "2.0.3"}}]}, "published": "2025-09-05T18:15:47.270", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/86b6d34717fe0570afce07ee79b8eeb40341f831"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a458b2902115b26a25d67393b12ddd57d1216aaa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b3967c493799e63f648e9c7b6cb063aa2aed04e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f7878d47560d61e3f370aca3cebb8f42a55b990a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ff55a452d56490047f5233cc48c5d933f8586884"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-203"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ipv6: sr: Fix MAC comparison to be constant-time", "id": "2393533", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2393533"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-39702", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39702\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39702\nhttps://lore.kernel.org/linux-cve-announce/2025090548-CVE-2025-39702-cb30@gregkh/T"], "threat_severity": "Important"}

{"created": "2025-09-06T09:01:40.910146+00:00", "updated": "2025-09-06T09:01:40.910199+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}