CVE-2025-40337

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40337", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.186Z", "datePublished": "2025-12-09T04:09:53.808Z", "dateUpdated": "2026-10-30T12:23:03.136Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:23:03.136Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Correctly handle Rx checksum offload errors\n\nThe stmmac_rx function would previously set skb->ip_summed to\nCHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled\nand the packet was of a known IP ethertype.\n\nHowever, this logic failed to check if the hardware had actually\nreported a checksum error. The hardware status, indicating a header or\npayload checksum failure, was being ignored at this stage. This could\ncause corrupt packets to be passed up the network stack as valid.\n\nThis patch corrects the logic by checking the `csum_none` status flag,\nwhich is set when the hardware reports a checksum error. If this flag\nis set, skb->ip_summed is now correctly set to CHECKSUM_NONE,\nensuring the kernel's network stack will perform its own validation and\nproperly handle the corrupt packet."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "baseScore": 8.2, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The bug is triggered by a received Ethernet frame whose TCP/UDP checksum the DWMAC engine flags as bad; L4 checksums are end-to-end and are neither validated nor repaired by intermediate routers (NAT's incremental update preserves the incorrect value), so an attacker anywhere on the internet can deliver the triggering packet to a stmmac interface. No local access or adjacency is needed.\nAC:L - The attacker directly controls the trigger \u2014 they simply write an incorrect checksum field into the packet they send, and the driver deterministically marks it CHECKSUM_UNNECESSARY. There is no race, no memory-layout dependency, and RX COE is enabled by default on all stmmac cores that advertise it.\nPR:N - The vulnerable code is in the NAPI receive path, executed on every inbound frame before any socket, authentication, or authorization check. An unauthenticated remote sender needs no credentials or account on the target.\nUI:N - Packet reception and NAPI processing happen automatically; no action by any local user or administrator is required for the corrupt packet to be accepted and delivered up the stack.\nS:U - The mis-marked skb is consumed by the same host's network stack and its applications; no VM, IOMMU, or sandbox boundary is crossed, so the vulnerable and impacted components share one security authority.\nC:N - The flaw only mislabels a checksum result \u2014 there is no out-of-bounds read, no uninitialized memory exposure, and no kernel data is disclosed to the attacker. Packet lengths still come from independently validated IP header fields.\nI:H - The kernel affirmatively asserts \"checksum verified\" for packets the hardware reported as corrupt, so the transport-layer integrity protection for all received IP traffic on the interface is completely lost and corrupt or attacker-mangled payloads reach applications as authentic. It also lets an attacker inject TCP segments that checksum-validating IDS/IPS and passive monitors discard but the host accepts, a security-control bypass and stream-desynchronization attack.\nA:L - Accepted corrupt segments \u2014 flipped control flags, mangled payloads \u2014 cause spurious connection teardowns and application-level protocol failures, degrading service reliability. There is no kernel crash, hang, or deadlock in this path, so the availability loss is partial rather than total."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "versions": [{"version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "lessThan": "3c5e5fccc4138c072d99be4ebe6b16df6a70a40c", "status": "affected", "versionType": "git"}, {"version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "lessThan": "63fbe0e6413279d5ea5842e2423e351ded547683", "status": "affected", "versionType": "git"}, {"version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "lessThan": "719fcdf29051f7471d5d433475af76219019d33d", "status": "affected", "versionType": "git"}, {"version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "lessThan": "1aa319e0f12d2d761a31556b82a5852c98eb0bea", "status": "affected", "versionType": "git"}, {"version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "lessThan": "ee0aace5f844ef59335148875d05bec8764e71e8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "versions": [{"version": "3.2", "status": "affected"}, {"version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.117", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.58", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.8", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.6.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.12.58"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.17.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "6.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3c5e5fccc4138c072d99be4ebe6b16df6a70a40c"}, {"url": "https://git.kernel.org/stable/c/63fbe0e6413279d5ea5842e2423e351ded547683"}, {"url": "https://git.kernel.org/stable/c/719fcdf29051f7471d5d433475af76219019d33d"}, {"url": "https://git.kernel.org/stable/c/1aa319e0f12d2d761a31556b82a5852c98eb0bea"}, {"url": "https://git.kernel.org/stable/c/ee0aace5f844ef59335148875d05bec8764e71e8"}], "title": "net: stmmac: Correctly handle Rx checksum offload errors", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3c5e5fccc4138c072d99be4ebe6b16df6a70a40c", "status": "affected", "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "versionType": "git"}, {"lessThan": "63fbe0e6413279d5ea5842e2423e351ded547683", "status": "affected", "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "versionType": "git"}, {"lessThan": "719fcdf29051f7471d5d433475af76219019d33d", "status": "affected", "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "versionType": "git"}, {"lessThan": "1aa319e0f12d2d761a31556b82a5852c98eb0bea", "status": "affected", "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "versionType": "git"}, {"lessThan": "ee0aace5f844ef59335148875d05bec8764e71e8", "status": "affected", "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"lessThan": "3.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.117", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.58", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Correctly handle Rx checksum offload errors\n\nThe stmmac_rx function would previously set skb->ip_summed to\nCHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled\nand the packet was of a known IP ethertype.\n\nHowever, this logic failed to check if the hardware had actually\nreported a checksum error. The hardware status, indicating a header or\npayload checksum failure, was being ignored at this stage. This could\ncause corrupt packets to be passed up the network stack as valid.\n\nThis patch corrects the logic by checking the `csum_none` status flag,\nwhich is set when the hardware reports a checksum error. If this flag\nis set, skb->ip_summed is now correctly set to CHECKSUM_NONE,\nensuring the kernel's network stack will perform its own validation and\nproperly handle the corrupt packet."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: stmmac: Manejar correctamente los errores de descarga de suma de verificaci\u00f3n Rx\n\nLa funci\u00f3n stmmac_rx anteriormente establec\u00eda skb -> ip_summed a CHECKSUM_UNNECESSARY si la descarga de suma de verificaci\u00f3n por hardware (CoE) estaba habilitada y el paquete era de un tipo de ethernet IP conocido.\n\nSin embargo, esta l\u00f3gica no verificaba si el hardware hab\u00eda reportado realmente un error de suma de verificaci\u00f3n. El estado del hardware, que indicaba un fallo de suma de verificaci\u00f3n de encabezado o de carga \u00fatil, estaba siendo ignorado en esta etapa. Esto podr\u00eda causar que paquetes corruptos se pasaran a la pila de red como v\u00e1lidos.\n\nEste parche corrige la l\u00f3gica al verificar el indicador de estado 'csum_none', que se establece cuando el hardware reporta un error de suma de verificaci\u00f3n. Si este indicador est\u00e1 establecido, skb -> ip_summed ahora se establece correctamente a CHECKSUM_NONE, asegurando que la pila de red del kernel realizar\u00e1 su propia validaci\u00f3n y manejar\u00e1 correctamente el paquete corrupto."}], "id": "CVE-2025-40337", "lastModified": "2026-10-30T13:18:16.447", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2025-12-09T16:17:43.923", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1aa319e0f12d2d761a31556b82a5852c98eb0bea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3c5e5fccc4138c072d99be4ebe6b16df6a70a40c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63fbe0e6413279d5ea5842e2423e351ded547683"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/719fcdf29051f7471d5d433475af76219019d33d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ee0aace5f844ef59335148875d05bec8764e71e8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: net: stmmac: Correctly handle Rx checksum offload errors", "id": "2420419", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2420419"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-40337", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40337\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40337\nhttps://lore.kernel.org/linux-cve-announce/2025120911-CVE-2025-40337-d3bd@gregkh/T"], "threat_severity": "Moderate"}

{}