CVE-2025-40337

{
  "id": "CVE-2025-40337",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-12-09T16:17:43.923",
  "lastModified": "2026-10-30T13:18:16.447",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Correctly handle Rx checksum offload errors\n\nThe stmmac_rx function would previously set skb->ip_summed to\nCHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled\nand the packet was of a known IP ethertype.\n\nHowever, this logic failed to check if the hardware had actually\nreported a checksum error. The hardware status, indicating a header or\npayload checksum failure, was being ignored at this stage. This could\ncause corrupt packets to be passed up the network stack as valid.\n\nThis patch corrects the logic by checking the `csum_none` status flag,\nwhich is set when the hardware reports a checksum error. If this flag\nis set, skb->ip_summed is now correctly set to CHECKSUM_NONE,\nensuring the kernel's network stack will perform its own validation and\nproperly handle the corrupt packet."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: stmmac: Manejar correctamente los errores de descarga de suma de verificación Rx\n\nLa función stmmac_rx anteriormente establecía skb -> ip_summed a CHECKSUM_UNNECESSARY si la descarga de suma de verificación por hardware (CoE) estaba habilitada y el paquete era de un tipo de ethernet IP conocido.\n\nSin embargo, esta lógica no verificaba si el hardware había reportado realmente un error de suma de verificación. El estado del hardware, que indicaba un fallo de suma de verificación de encabezado o de carga útil, estaba siendo ignorado en esta etapa. Esto podría causar que paquetes corruptos se pasaran a la pila de red como válidos.\n\nEste parche corrige la lógica al verificar el indicador de estado 'csum_none', que se establece cuando el hardware reporta un error de suma de verificación. Si este indicador está establecido, skb -> ip_summed ahora se establece correctamente a CHECKSUM_NONE, asegurando que la pila de red del kernel realizará su propia validación y manejará correctamente el paquete corrupto."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0",
              "lessThan": "3c5e5fccc4138c072d99be4ebe6b16df6a70a40c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0",
              "lessThan": "63fbe0e6413279d5ea5842e2423e351ded547683",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0",
              "lessThan": "719fcdf29051f7471d5d433475af76219019d33d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0",
              "lessThan": "1aa319e0f12d2d761a31556b82a5852c98eb0bea",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "3c20f72f9108b2fcf30ec63d8a4203736c01ccd0",
              "lessThan": "ee0aace5f844ef59335148875d05bec8764e71e8",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.2",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.2",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.191",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.117",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.58",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.8",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1aa319e0f12d2d761a31556b82a5852c98eb0bea",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3c5e5fccc4138c072d99be4ebe6b16df6a70a40c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/63fbe0e6413279d5ea5842e2423e351ded547683",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/719fcdf29051f7471d5d433475af76219019d33d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ee0aace5f844ef59335148875d05bec8764e71e8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}