CVE-2025-39770

Q: What is the severity of CVE-2025-39770?

CVE-2025-39770 has a CVSS score of 5.5 (MEDIUM). A Linux kernel vulnerability where IPv6 packets with extension headers incorrectly request checksum offload on devices that only support NETIF_F_IPV6_CSUM, which explicitly doesn't support packets with extension headers. This causes network throughput collapse with warning messages in kernel logs. Affects Linux systems using IPv6 with extension headers (like GREoIPv6 tunnels) on compatible network hardware.

5.5 MEDIUM

📋 TL;DR

A Linux kernel vulnerability where IPv6 packets with extension headers incorrectly request checksum offload on devices that only support NETIF_F_IPV6_CSUM, which explicitly doesn't support packets with extension headers. This causes network throughput collapse with warning messages in kernel logs. Affects Linux systems using IPv6 with extension headers (like GREoIPv6 tunnels) on compatible network hardware.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific affected versions not specified in CVE, but patches available for stable branches

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when using IPv6 with extension headers (like GRE tunnels) on network devices that only advertise NETIF_F_IPV6_CSUM feature. BIG TCP extensions are explicitly excluded.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete network throughput collapse for affected IPv6 traffic, causing denial of service for applications using IPv6 with extension headers.

🟠

Likely Case

Network performance degradation and kernel warning messages when IPv6 packets with extension headers are processed on affected devices.

🟢

If Mitigated

No impact if IPv6 extension headers aren't used or if devices support full IPv6 offload features beyond just NETIF_F_IPV6_CSUM.

🌐 Internet-Facing: MEDIUM - Affects IPv6 traffic which may be internet-facing, but requires specific network configurations and hardware.

🏢 Internal Only: MEDIUM - Similar impact for internal networks using IPv6 with extension headers on affected hardware.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires ability to send IPv6 packets with extension headers to affected systems. This is a denial of service vulnerability rather than a privilege escalation or code execution flaw.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel branches via provided git commits

Vendor Advisory: https://git.kernel.org/stable/c/041e2f945f82fdbd6fff577b79c33469430297aa

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable IPv6 extension headers

all

Prevent use of IPv6 extension headers that trigger the vulnerability

# Configure network to avoid IPv6 extension headers
# Disable specific IPv6 tunnel protocols if not needed

Disable checksum offload

Linux

Force software checksum calculation instead of hardware offload

ethtool -K <interface> tx-ipv6-csum-offload off

🧯 If You Can't Patch

Avoid using IPv6 with extension headers on affected network interfaces
Use network devices that support full IPv6 offload features beyond just NETIF_F_IPV6_CSUM

🔍 How to Verify

Check if Vulnerable:

Monitor kernel logs for 'skb_warn_bad_offload' warnings when processing IPv6 traffic with extension headers

Check Version:

uname -r

Verify Fix Applied:

Check kernel version includes the fix commits and verify no 'skb_warn_bad_offload' warnings appear during IPv6 traffic with extension headers

📡 Detection & Monitoring

Log Indicators:

WARNING: CPU: ... at net/core/dev.c:3535 skb_warn_bad_offload
kernel messages about bad offload for IPv6 packets

Network Indicators:

Sudden throughput drops for IPv6 traffic with extension headers
Increased CPU usage for network processing

SIEM Query:

source="kernel" AND "skb_warn_bad_offload" AND "IPv6"

📊 Metadata

CVE ID: CVE-2025-39770

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Score: 0.01% exploit probability (1.1th percentile)

Published: September 11, 2025

Last Updated: January 16, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable IPv6 extension headers

Disable checksum offload

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export