linux-cve-announce - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025081910-CVE-2025-38572-200b@gregkh>
Date: Tue, 19 Aug 2025 19:18:19 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ipv6: reject malicious packets in ipv6_gso_segment()

syzbot was able to craft a packet with very long IPv6 extension headers
leading to an overflow of skb->transport_header.

This 16bit field has a limited range.

Add skb_reset_transport_header_careful() helper and use it
from ipv6_gso_segment()

WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
Modules linked in:
CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline]
 RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
Call Trace:
 <TASK>
  skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
  nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110
  skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53
  __skb_gso_segment+0x342/0x510 net/core/gso.c:124
  skb_gso_segment include/net/gso.h:83 [inline]
  validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950
  validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000
  sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329
  __dev_xmit_skb net/core/dev.c:4102 [inline]
  __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679

The Linux kernel CVE team has assigned CVE-2025-38572 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.8 with commit d1da932ed4ecad2a14cbcc01ed589d617d0f0f09 and fixed in 6.1.148 with commit de322cdf600fc9433845a9e944d1ca6b31cfb67e
	Issue introduced in 3.8 with commit d1da932ed4ecad2a14cbcc01ed589d617d0f0f09 and fixed in 6.6.102 with commit ef05007b403dcc21e701cb1f30d4572ac0a9da20
	Issue introduced in 3.8 with commit d1da932ed4ecad2a14cbcc01ed589d617d0f0f09 and fixed in 6.12.42 with commit 5489e7fc6f8be3062f8cb7e49406de4bfd94db67
	Issue introduced in 3.8 with commit d1da932ed4ecad2a14cbcc01ed589d617d0f0f09 and fixed in 6.15.10 with commit 573b8250fc2554761db3bc2bbdbab23789d52d4e
	Issue introduced in 3.8 with commit d1da932ed4ecad2a14cbcc01ed589d617d0f0f09 and fixed in 6.16.1 with commit ee851768e4b8371ce151fd446d24bf3ae2d18789
	Issue introduced in 3.8 with commit d1da932ed4ecad2a14cbcc01ed589d617d0f0f09 and fixed in 6.17-rc1 with commit d45cf1e7d7180256e17c9ce88e32e8061a7887fe

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38572
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/linux/skbuff.h
	net/ipv6/ip6_offload.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/de322cdf600fc9433845a9e944d1ca6b31cfb67e
	https://git.kernel.org/stable/c/ef05007b403dcc21e701cb1f30d4572ac0a9da20
	https://git.kernel.org/stable/c/5489e7fc6f8be3062f8cb7e49406de4bfd94db67
	https://git.kernel.org/stable/c/573b8250fc2554761db3bc2bbdbab23789d52d4e
	https://git.kernel.org/stable/c/ee851768e4b8371ce151fd446d24bf3ae2d18789
	https://git.kernel.org/stable/c/d45cf1e7d7180256e17c9ce88e32e8061a7887fe