---
id: CVE-2025-40337
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: stmmac: Correctly handle Rx checksum offload errors

  The stmmac_rx function would previously set skb->ip_summed to
  CHECKSUM_UNNECESSARY if hardware checksum offloa…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: stmmac: Correctly handle Rx checksum offload errors

  The stmmac_rx function would previously set skb->ip_summed to
  CHECKSUM_UNNECESSARY if hardware checksum offloa…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L'
published: '2025-12-09'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T22:10:00.210'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-40337'
references:
  - url: 'https://git.kernel.org/stable/c/1aa319e0f12d2d761a31556b82a5852c98eb0bea'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/63fbe0e6413279d5ea5842e2423e351ded547683'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/719fcdf29051f7471d5d433475af76219019d33d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ee0aace5f844ef59335148875d05bec8764e71e8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00481
epssPercentile: 0.3993
ingestedAt: '2026-10-14T23:00:02.032Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: Correctly handle Rx checksum offload errors

The stmmac_rx function would previously set skb->ip_summed to
CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled
and the packet was of a known IP ethertype.

However, this logic failed to check if the hardware had actually
reported a checksum error. The hardware status, indicating a header or
payload checksum failure, was being ignored at this stage. This could
cause corrupt packets to be passed up the network stack as valid.

This patch corrects the logic by checking the `csum_none` status flag,
which is set when the hardware reports a checksum error. If this flag
is set, skb->ip_summed is now correctly set to CHECKSUM_NONE,
ensuring the kernel's network stack will perform its own validation and
properly handle the corrupt packet.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.