Skip to main content

Linux Kernel CVE-2025-40337

HIGH
2025-12-09 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
8.2
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain on-path or adjacent network position
  2. Delivery
    Send frames with failing L3/L4 checksums
  3. Exploit
    Driver ignores hardware csum error flag
  4. Execution
    Kernel marks packet CHECKSUM_UNNECESSARY
  5. Impact
    Corrupt data delivered to application

Vulnerability Assessment

Exploitation Conditions

Exploitation requires an affected system using the stmmac Ethernet driver with hardware checksum offload (CoE) enabled - this is the exact configuration condition, since the flawed path only executes when CoE is on and the frame is a recognized IP ethertype. The attacker must be able to place frames that fail hardware checksum validation onto the target's link (on-path/adjacent position or a sender that emits checksum-failing frames). Limiting factors: it only affects stmmac/DesignWare MAC hardware, requires CoE to be enabled (default on many but not all platforms), the impact is confined to acceptance of already-corrupt data (no code execution), and the vector is not disabled by authentication but is constrained by needing to induce checksum-error frames.
Impact

The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L, base 8.2) emphasizes network reach with high integrity impact and no confidentiality impact, which is consistent with corrupt data being accepted rather than information disclosure - note the 'Information Disclosure' tag conflicts with the C:N vector and appears mislabeled. However, real-world signals are muted: EPSS is only 0.20% (11th percentile), there is no KEV listing, and no POC is referenced (only upstream fix commits). The I:H rating is arguably aggressive: the practical effect is that a frame with a bad L3/L4 checksum is not rejected, but higher-layer protocols (TCP/UDP application data) often carry their own end-to-end integrity checks, and triggering the condition requires actually inducing checksum-failing frames on the wire. This is best treated as a correctness/robustness fix for embedded networking rather than an urgent, remotely weaponizable vulnerability; prioritize it in kernel maintenance cadence for affected SoC platforms, not as an emergency.
Exploit ScenarioDerived

An attacker or a lossy/tampered link segment delivers Ethernet frames with corrupted IP/TCP/UDP payloads whose hardware checksum verification fails; on an unpatched stmmac interface the driver marks them CHECKSUM_UNNECESSARY, so the kernel forwards the corrupt data to the application without revalidating. No public exploit code is identified, and reliably triggering acceptance of specific corrupted content over the network (AV:N) is non-trivial, so realistic abuse leans toward on-path attackers or degraded links rather than trivial remote exploitation.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Data-integrity corruption in the Linux kernel's stmmac (Synopsys DesignWare/STMMAC) Ethernet driver allows malformed packets that failed hardware checksum validation to be accepted as valid by the network stack. When hardware checksum offload (CoE) is enabled, the Rx path marked known IP-ethertype frames as CHECKSUM_UNNECESSARY without honoring the hardware's reported header/payload checksum error, so corrupt frames bypass the stack's own validation. There is no public exploit identified at time of analysis, KEV status is not listed, and EPSS is low (0.20%, 11th percentile).

RemediationAI

Upstream fix available (commits/PR); a released patched version is not independently confirmed from the input - apply the kernel update from your distribution or stable branch that includes the stmmac Rx checksum fix, referencing the stable commits at https://git.kernel.org/stable/c/1aa319e0f12d2d761a31556b82a5852c98eb0bea and the sibling backports (63fbe0e6413279d5ea5842e2423e351ded547683, 719fcdf29051f7471d5d433475af76219019d33d, ee0aace5f844ef59335148875d05bec8764e71e8). As a workaround where you cannot immediately patch, you can disable Rx hardware checksum offload on the affected interface with 'ethtool -K <iface> rx off' (and 'rx-checksum off'), which forces the kernel to validate all checksums in software and closes the flaw at the cost of increased CPU utilization on high-throughput links. Do not disable software checksum validation as a mitigation, and prefer the kernel update since the offload workaround only masks the driver bug.

Affected ProductsAI

The affected component is the stmmac network driver in the mainline Linux kernel (drivers/net/ethernet/stmicro/stmmac). No CPE strings or explicit version ranges were provided in the input; the four referenced git.kernel.org/stable commits (1aa319e, 63fbe0e, 719fcdf, ee0aace) indicate the fix was backported across multiple stable branches, implying a broad range of kernel versions with the CoE Rx path is affected until patched. Impact is limited to platforms whose Ethernet is driven by stmmac with hardware checksum offload enabled. Refer to the kernel stable tree commits for the precise affected/patched versions per branch, as no single vendor advisory URL or fixed tag was supplied.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The stmmac driver services the Synopsys DesignWare MAC IP block, which is embedded in many ARM/RISC SoCs and some Intel platforms (STMicroelectronics STi, Rockchip, Amlogic, Allwinner, etc.). Modern MACs support Checksum Offload Engine (CoE), computing IPv4/TCP/UDP checksums in hardware and reporting results via descriptor status bits. In the flawed logic, stmmac_rx() set skb->ip_summed = CHECKSUM_UNNECESSARY whenever CoE was on and the frame was a recognized IP ethertype, ignoring the descriptor's error indication. The root cause is improper validation of a security/integrity-relevant check result (conceptually CWE-354, Improper Validation of Integrity Check Value; no CWE was assigned in the input). The fix consults the csum_none status flag and instead sets CHECKSUM_NONE so the kernel software-validates the packet.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 8.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
vuln.today AI 3.7 LOW

Network-reachable but requires inducing checksum-failing frames (AC:H); impact is acceptance of corrupt data (I:L), with no confidentiality or availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
Low

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: Correctly handle Rx checksum offload errors

The stmmac_rx function would previously set skb->ip_summed to CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled and the packet was of a known IP ethertype.

However, this logic failed to check if the hardware had actually reported a checksum error. The hardware status, indicating a header or payload checksum failure, was being ignored at this stage. This could cause corrupt packets to be passed up the network stack as valid.

This patch corrects the logic by checking the csum_none status flag, which is set when the hardware reports a checksum error. If this flag is set, skb->ip_summed is now correctly set to CHECKSUM_NONE, ensuring the kernel's network stack will perform its own validation and properly handle the corrupt packet.

Executive ViewAI

Why It Matters

CVE-2025-40337 affects Linux systems running stmmac Ethernet drivers with hardware checksum offload enabled, allowing malformed network packets to bypass validation and corrupt data in transit silently. No public exploit identified at time of analysis; however, with a CVSS score of 8.2, the vulnerability carries significant severity for affected infrastructure and should be treated as a priority data integrity risk. Organizations using stmmac drivers should immediately audit their network stack configuration and implement mitigations to disable or work around this data corruption vector.

Business Impact: High
Compensating Controls

Disable hardware checksum offload (CoE) on affected interfaces using ethtool -K tx off rx off; enable software-based packet validation; implement network segmentation to minimize blast radius. No vendor-released patch identified at time of analysis; monitor kernel advisories for updates.

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Prevalence
Medium
stmmac drives Ethernet on many ARM/RISC SoCs but not general servers
Data Quality
4 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.0/toolbox:latest Affected

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/334923 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0278/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0281/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0315/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0316/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20207/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20220/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20228/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20477/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20479/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20498/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20520/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20564/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20772/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20794/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20819/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20845/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20872/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20876/ REF https://git.kernel.org/stable/c/1aa319e0f12d2d761a31556b82a5852c98eb0bea REF https://git.kernel.org/stable/c/3c5e5fccc4138c072d99be4ebe6b16df6a70a40c REF https://git.kernel.org/stable/c/63fbe0e6413279d5ea5842e2423e351ded547683 REF https://git.kernel.org/stable/c/719fcdf29051f7471d5d433475af76219019d33d REF https://git.kernel.org/stable/c/ee0aace5f844ef59335148875d05bec8764e71e8

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy