net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
In the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incorrectly requests checksum offload if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has a strict contract: it supports checksum offload only for plain TCP or UDP over IPv6 and explicitly does not support packets with extension headers. The current GSO logic violates this contract by failing to disable the feature for packets with extension headers, such as those used in GREoIPv6 tunnels. This violation results in the device being asked to perform an operation it cannot support, leading to a `skb_warn_bad_offload` warning and a collapse of network throughput. While device TSO/USO is correctly bypassed in favor of software GSO for these packets, the GSO stack must be explicitly told not to request checksum offload. Mask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4 in gso_features_check if the IPv6 header contains extension headers to compute checksum in software. The exception is a BIG TCP extension, which, as stated in commit 68e068cabd2c6c53 ("net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets"): "The feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump, and not transmitted by physical devices." kernel log output (trun
CVE-2025-39770
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-39770
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a84978a9cda68f0afe3f01d476c68db21526baf1",
"lessThan": "a0478d7e888028f85fa7785ea838ce0ca09398e2",
"versionType": "git"
},
{
"status": "affected",
"version": "c69bc67c1cb211aa390bea6e512bb01b1241fefb",
"lessThan": "2156d9e9f2e483c8c3906c0ea57ea312c1424235",
"versionType": "git"
},
{
"status": "affected",
"version": "04c20a9356f283da623903e81e7c6d5df7e4dc3c",
"lessThan": "041e2f945f82fdbd6fff577b79c33469430297aa",
"versionType": "git"
},
{
"status": "affected",
"version": "04c20a9356f283da623903e81e7c6d5df7e4dc3c",
"lessThan": "794ddbb7b63b6828c75967b9bcd43b086716e7a1",
"versionType": "git"
},
{
"status": "affected",
"version": "04c20a9356f283da623903e81e7c6d5df7e4dc3c",
"lessThan": "864e3396976ef41de6cc7bc366276bf4e084fff2",
"versionType": "git"
},
{
"status": "affected",
"version": "bcefc3cd7f592a70fcbbbfd7ad1fbc69172ea78b",
"versionType": "git"
},
{
"status": "affected",
"version": "477b35d94a21530046fe91589960732fcf2b29ed",
"versionType": "git"
},
{
"status": "affected",
"version": "a27a5c40ee4cbe00294e2c76160de5f2589061ba",
"versionType": "git"
},
{
"status": "affected",
"version": "9f605135a5c0fe614c2b15197b9ced1e217eca59",
"versionType": "git"
},
{
"status": "affected",
"version": "705350fbd6ed4b5d89ee045fa57a0594a72b17d7",
"versionType": "git"
},
{
"status": "affected",
"version": "6.1.116",
"lessThan": "6.1.149",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.6.60",
"lessThan": "6.6.103",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.19.323",
"lessThan": "4.20",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.4.285",
"lessThan": "5.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.10.229",
"lessThan": "5.11",
"versionType": "semver"
},
{
"status": "affected",
"version": "5.15.171",
"lessThan": "5.16",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.11.7",
"lessThan": "6.12",
"versionType": "semver"
}
],
"programFiles": [
"net/core/dev.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.12"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.12",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.149",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.103",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.44",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.16.4",
"versionType": "semver",
"lessThanOrEqual": "6.16.*"
},
{
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/core/dev.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-39770
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #27063 · Revision 1
- Added to Heist Feed
- Publisher date