{"id":"CVE-2025-39770","title":"net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM\n\nWhen performing Generic Segmentation Offload (GSO) on an IPv6 packet that\ncontains extension h…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= a84978a9cda68f0afe3f01d476c68db21526baf1 < a0478d7e888028f85fa7785ea838ce0ca09398e2","Linux >= c69bc67c1cb211aa390bea6e512bb01b1241fefb < 2156d9e9f2e483c8c3906c0ea57ea312c1424235","Linux >= 04c20a9356f283da623903e81e7c6d5df7e4dc3c < 041e2f945f82fdbd6fff577b79c33469430297aa","Linux >= 04c20a9356f283da623903e81e7c6d5df7e4dc3c < 794ddbb7b63b6828c75967b9bcd43b086716e7a1","Linux >= 04c20a9356f283da623903e81e7c6d5df7e4dc3c < 864e3396976ef41de6cc7bc366276bf4e084fff2","Linux bcefc3cd7f592a70fcbbbfd7ad1fbc69172ea78b","Linux 477b35d94a21530046fe91589960732fcf2b29ed","Linux a27a5c40ee4cbe00294e2c76160de5f2589061ba","Linux 9f605135a5c0fe614c2b15197b9ced1e217eca59","Linux 705350fbd6ed4b5d89ee045fa57a0594a72b17d7","Linux >= 6.1.116 < 6.1.149","Linux >= 6.6.60 < 6.6.103","Linux >= 4.19.323 < 4.20","Linux >= 5.4.285 < 5.5","Linux >= 5.10.229 < 5.11","Linux >= 5.15.171 < 5.16","Linux >= 6.11.7 < 6.12","Linux 6.12"],"published":"2025-09-11","updated":"2026-09-08","sourceUpdated":"2026-09-08T08:42:15.357Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-39770","references":[{"url":"https://git.kernel.org/stable/c/a0478d7e888028f85fa7785ea838ce0ca09398e2"},{"url":"https://git.kernel.org/stable/c/2156d9e9f2e483c8c3906c0ea57ea312c1424235"},{"url":"https://git.kernel.org/stable/c/041e2f945f82fdbd6fff577b79c33469430297aa"},{"url":"https://git.kernel.org/stable/c/794ddbb7b63b6828c75967b9bcd43b086716e7a1"},{"url":"https://git.kernel.org/stable/c/864e3396976ef41de6cc7bc366276bf4e084fff2"}],"tags":["cve.org"],"epss":0.00357,"epssPercentile":0.29546,"ingestedAt":"2026-09-08T15:33:26.997Z","slug":"CVE-2025-39770","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM\n\nWhen performing Generic Segmentation Offload (GSO) on an IPv6 packet that\ncontains extension headers, the kernel incorrectly requests checksum offload\nif the egress device only advertises NETIF_F_IPV6_CSUM feature, which has\na strict contract: it supports checksum offload only for plain TCP or UDP\nover IPv6 and explicitly does not support packets with extension headers.\nThe current GSO logic violates this contract by failing to disable the feature\nfor packets with extension headers, such as those used in GREoIPv6 tunnels.\n\nThis violation results in the device being asked to perform an operation\nit cannot support, leading to a `skb_warn_bad_offload` warning and a collapse\nof network throughput. While device TSO/USO is correctly bypassed in favor\nof software GSO for these packets, the GSO stack must be explicitly told not\nto request checksum offload.\n\nMask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4\nin gso_features_check if the IPv6 header contains extension headers to compute\nchecksum in software.\n\nThe exception is a BIG TCP extension, which, as stated in commit\n68e068cabd2c6c53 (\"net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets\"):\n\"The feature is only enabled on devices that support BIG TCP TSO.\nThe header is only present for PF_PACKET taps like tcpdump,\nand not transmitted by physical devices.\"\n\nkernel log output (truncated):\nWARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140\n...\nCall Trace:\n <TASK>\n skb_checksum_help+0x12a/0x1f0\n validate_xmit_skb+0x1a3/0x2d0\n validate_xmit_skb_list+0x4f/0x80\n sch_direct_xmit+0x1a2/0x380\n __dev_xmit_skb+0x242/0x670\n __dev_queue_xmit+0x3fc/0x7f0\n ip6_finish_output2+0x25e/0x5d0\n ip6_finish_output+0x1fc/0x3f0\n ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel]\n ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre]\n dev_hard_start_xmit+0x63/0x1c0\n __dev_queue_xmit+0x6d0/0x7f0\n ip6_finish_output2+0x214/0x5d0\n ip6_finish_output+0x1fc/0x3f0\n ip6_xmit+0x2ca/0x6f0\n ip6_finish_output+0x1fc/0x3f0\n ip6_xmit+0x2ca/0x6f0\n inet6_csk_xmit+0xeb/0x150\n __tcp_transmit_skb+0x555/0xa80\n tcp_write_xmit+0x32a/0xe90\n tcp_sendmsg_locked+0x437/0x1110\n tcp_sendmsg+0x2f/0x50\n...\nskb linear:   00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e\nskb linear:   00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00\nskb linear:   00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00\nskb linear:   00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00\nskb linear:   00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00\nskb linear:   00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00\nskb linear:   00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9\nskb linear:   00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01\nskb linear:   00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a\n\n## Affected\n\n- `Linux >= a84978a9cda68f0afe3f01d476c68db21526baf1 < a0478d7e888028f85fa7785ea838ce0ca09398e2`\n- `Linux >= c69bc67c1cb211aa390bea6e512bb01b1241fefb < 2156d9e9f2e483c8c3906c0ea57ea312c1424235`\n- `Linux >= 04c20a9356f283da623903e81e7c6d5df7e4dc3c < 041e2f945f82fdbd6fff577b79c33469430297aa`\n- `Linux >= 04c20a9356f283da623903e81e7c6d5df7e4dc3c < 794ddbb7b63b6828c75967b9bcd43b086716e7a1`\n- `Linux >= 04c20a9356f283da623903e81e7c6d5df7e4dc3c < 864e3396976ef41de6cc7bc366276bf4e084fff2`\n- `Linux bcefc3cd7f592a70fcbbbfd7ad1fbc69172ea78b`\n- `Linux 477b35d94a21530046fe91589960732fcf2b29ed`\n- `Linux a27a5c40ee4cbe00294e2c76160de5f2589061ba`\n- `Linux 9f605135a5c0fe614c2b15197b9ced1e217eca59`\n- `Linux 705350fbd6ed4b5d89ee045fa57a0594a72b17d7`\n- `Linux >= 6.1.116 < 6.1.149`\n- `Linux >= 6.6.60 < 6.6.103`\n- `Linux >= 4.19.323 < 4.20`\n- `Linux >= 5.4.285 < 5.5`\n- `Linux >= 5.10.229 < 5.11`\n- `Linux >= 5.15.171 < 5.16`\n- `Linux >= 6.11.7 < 6.12`\n- `Linux 6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}