In the Linux kernel, the following vulnerability has been resolved:
ipv6: reject malicious packets in ipv6gsosegment()
syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header.
This 16bit field has a limited range.
Add skbresettransportheadercareful() helper and use it from ipv6gsosegment()
WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skbresettransportheader include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6gsosegment+0x15e2/0x21e0 net/ipv6/ip6offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skbresettransportheader include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6gsosegment+0x15e2/0x21e0 net/ipv6/ip6offload.c:151 Call Trace: <TASK> skbmacgsosegment+0x31c/0x640 net/core/gso.c:53 nshgsosegment+0x54a/0xe10 net/nsh/nsh.c:110 skbmacgsosegment+0x31c/0x640 net/core/gso.c:53 _skbgsosegment+0x342/0x510 net/core/gso.c:124 skbgsosegment include/net/gso.h:83 [inline] validatexmitskb+0x857/0x11b0 net/core/dev.c:3950 validatexmitskblist+0x84/0x120 net/core/dev.c:4000 schdirectxmit+0xd3/0x4b0 net/sched/schgeneric.c:329 _devxmitskb net/core/dev.c:4102 [inline] _devqueue_xmit+0x17b6/0x3a70 net/core/dev.c:4679
[ { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de322cdf600fc9433845a9e944d1ca6b31cfb67e", "signature_type": "Line", "digest": { "line_hashes": [ "281983563305516826177984576477407539008", "244998937363614261925296960635348597956", "278246679188240298942350968909082322194", "201945252829398697221870858388886781519" ], "threshold": 0.9 }, "target": { "file": "net/ipv6/ip6_offload.c" }, "id": "CVE-2025-38572-0d197b83", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d45cf1e7d7180256e17c9ce88e32e8061a7887fe", "signature_type": "Function", "digest": { "length": 2230.0, "function_hash": "275476755045058195240646154346018295120" }, "target": { "file": "net/ipv6/ip6_offload.c", "function": "ipv6_gso_segment" }, "id": "CVE-2025-38572-30f9c725", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de322cdf600fc9433845a9e944d1ca6b31cfb67e", "signature_type": "Function", "digest": { "length": 2576.0, "function_hash": "268911587904003549672815998889494808781" }, "target": { "file": "net/ipv6/ip6_offload.c", "function": "ipv6_gso_segment" }, "id": "CVE-2025-38572-3ba49cf5", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5dc60b2a00ed7629214ac0c48e43f40af2078703", "signature_type": "Line", "digest": { "line_hashes": [ "53715169304794543804023386804095174425", "270137694372375286778598391762564546953", "228235940959050524720378253983283968900" ], "threshold": 0.9 }, "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2025-38572-45b4f0a6", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee851768e4b8371ce151fd446d24bf3ae2d18789", "signature_type": "Line", "digest": { "line_hashes": [ "281983563305516826177984576477407539008", "244998937363614261925296960635348597956", "278246679188240298942350968909082322194", "201945252829398697221870858388886781519" ], "threshold": 0.9 }, "target": { "file": "net/ipv6/ip6_offload.c" }, "id": "CVE-2025-38572-4a5e25ed", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d45cf1e7d7180256e17c9ce88e32e8061a7887fe", "signature_type": "Line", "digest": { "line_hashes": [ "62288323434459823463394603743727304737", "252051130923495420802025930572194816100", "228235940959050524720378253983283968900" ], "threshold": 0.9 }, "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2025-38572-5545e68b", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09ff062b89d8e48165247d677d1ca23d6d607e9b", "signature_type": "Function", "digest": { "length": 2160.0, "function_hash": "21216347138995156150031372692609368324" }, "target": { "file": "net/ipv6/ip6_offload.c", "function": "ipv6_gso_segment" }, "id": "CVE-2025-38572-5e9a97d5", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5dc60b2a00ed7629214ac0c48e43f40af2078703", "signature_type": "Line", "digest": { "line_hashes": [ "281983563305516826177984576477407539008", "244998937363614261925296960635348597956", "278246679188240298942350968909082322194", "201945252829398697221870858388886781519" ], "threshold": 0.9 }, "target": { "file": "net/ipv6/ip6_offload.c" }, "id": "CVE-2025-38572-654920da", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee851768e4b8371ce151fd446d24bf3ae2d18789", "signature_type": "Function", "digest": { "length": 2230.0, "function_hash": "275476755045058195240646154346018295120" }, "target": { "file": "net/ipv6/ip6_offload.c", "function": "ipv6_gso_segment" }, "id": "CVE-2025-38572-782f9520", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee851768e4b8371ce151fd446d24bf3ae2d18789", "signature_type": "Line", "digest": { "line_hashes": [ "62288323434459823463394603743727304737", "252051130923495420802025930572194816100", "228235940959050524720378253983283968900" ], "threshold": 0.9 }, "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2025-38572-7be3ec06", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@573b8250fc2554761db3bc2bbdbab23789d52d4e", "signature_type": "Function", "digest": { "length": 2230.0, "function_hash": "275476755045058195240646154346018295120" }, "target": { "file": "net/ipv6/ip6_offload.c", "function": "ipv6_gso_segment" }, "id": "CVE-2025-38572-8fa93c59", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d45cf1e7d7180256e17c9ce88e32e8061a7887fe", "signature_type": "Line", "digest": { "line_hashes": [ "281983563305516826177984576477407539008", "244998937363614261925296960635348597956", "278246679188240298942350968909082322194", "201945252829398697221870858388886781519" ], "threshold": 0.9 }, "target": { "file": "net/ipv6/ip6_offload.c" }, "id": "CVE-2025-38572-962b486d", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05007b403dcc21e701cb1f30d4572ac0a9da20", "signature_type": "Function", "digest": { "length": 2230.0, "function_hash": "275476755045058195240646154346018295120" }, "target": { "file": "net/ipv6/ip6_offload.c", "function": "ipv6_gso_segment" }, "id": "CVE-2025-38572-a3143278", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f638e0b28bde7c3354a0df938ab3a96739455d1", "signature_type": "Function", "digest": { "length": 2160.0, "function_hash": "21216347138995156150031372692609368324" }, "target": { "file": "net/ipv6/ip6_offload.c", "function": "ipv6_gso_segment" }, "id": "CVE-2025-38572-a3c53eea", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5dc60b2a00ed7629214ac0c48e43f40af2078703", "signature_type": "Function", "digest": { "length": 2160.0, "function_hash": "21216347138995156150031372692609368324" }, "target": { "file": "net/ipv6/ip6_offload.c", "function": "ipv6_gso_segment" }, "id": "CVE-2025-38572-a76de7fe", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de322cdf600fc9433845a9e944d1ca6b31cfb67e", "signature_type": "Line", "digest": { "line_hashes": [ "53715169304794543804023386804095174425", "270137694372375286778598391762564546953", "228235940959050524720378253983283968900" ], "threshold": 0.9 }, "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2025-38572-a9f3e7b2", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5489e7fc6f8be3062f8cb7e49406de4bfd94db67", "signature_type": "Line", "digest": { "line_hashes": [ "53715169304794543804023386804095174425", "270137694372375286778598391762564546953", "228235940959050524720378253983283968900" ], "threshold": 0.9 }, "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2025-38572-c19c43bd", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@573b8250fc2554761db3bc2bbdbab23789d52d4e", "signature_type": "Line", "digest": { "line_hashes": [ "62288323434459823463394603743727304737", "252051130923495420802025930572194816100", "228235940959050524720378253983283968900" ], "threshold": 0.9 }, "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2025-38572-cddfeb24", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@573b8250fc2554761db3bc2bbdbab23789d52d4e", "signature_type": "Line", "digest": { "line_hashes": [ "281983563305516826177984576477407539008", "244998937363614261925296960635348597956", "278246679188240298942350968909082322194", "201945252829398697221870858388886781519" ], "threshold": 0.9 }, "target": { "file": "net/ipv6/ip6_offload.c" }, "id": "CVE-2025-38572-d8d4f3d5", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05007b403dcc21e701cb1f30d4572ac0a9da20", "signature_type": "Line", "digest": { "line_hashes": [ "281983563305516826177984576477407539008", "244998937363614261925296960635348597956", "278246679188240298942350968909082322194", "201945252829398697221870858388886781519" ], "threshold": 0.9 }, "target": { "file": "net/ipv6/ip6_offload.c" }, "id": "CVE-2025-38572-dd1f0ca4", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f638e0b28bde7c3354a0df938ab3a96739455d1", "signature_type": "Line", "digest": { "line_hashes": [ "53715169304794543804023386804095174425", "270137694372375286778598391762564546953", "228235940959050524720378253983283968900" ], "threshold": 0.9 }, "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2025-38572-e06b4d02", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f638e0b28bde7c3354a0df938ab3a96739455d1", "signature_type": "Line", "digest": { "line_hashes": [ "281983563305516826177984576477407539008", "244998937363614261925296960635348597956", "278246679188240298942350968909082322194", "201945252829398697221870858388886781519" ], "threshold": 0.9 }, "target": { "file": "net/ipv6/ip6_offload.c" }, "id": "CVE-2025-38572-e5cb30fe", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05007b403dcc21e701cb1f30d4572ac0a9da20", "signature_type": "Line", "digest": { "line_hashes": [ "53715169304794543804023386804095174425", "270137694372375286778598391762564546953", "228235940959050524720378253983283968900" ], "threshold": 0.9 }, "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2025-38572-e6991537", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5489e7fc6f8be3062f8cb7e49406de4bfd94db67", "signature_type": "Line", "digest": { "line_hashes": [ "281983563305516826177984576477407539008", "244998937363614261925296960635348597956", "278246679188240298942350968909082322194", "201945252829398697221870858388886781519" ], "threshold": 0.9 }, "target": { "file": "net/ipv6/ip6_offload.c" }, "id": "CVE-2025-38572-e7c1f75b", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09ff062b89d8e48165247d677d1ca23d6d607e9b", "signature_type": "Line", "digest": { "line_hashes": [ "53715169304794543804023386804095174425", "270137694372375286778598391762564546953", "228235940959050524720378253983283968900" ], "threshold": 0.9 }, "target": { "file": "include/linux/skbuff.h" }, "id": "CVE-2025-38572-eb92c4b3", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09ff062b89d8e48165247d677d1ca23d6d607e9b", "signature_type": "Line", "digest": { "line_hashes": [ "281983563305516826177984576477407539008", "244998937363614261925296960635348597956", "278246679188240298942350968909082322194", "201945252829398697221870858388886781519" ], "threshold": 0.9 }, "target": { "file": "net/ipv6/ip6_offload.c" }, "id": "CVE-2025-38572-ee58bffa", "signature_version": "v1" }, { "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5489e7fc6f8be3062f8cb7e49406de4bfd94db67", "signature_type": "Function", "digest": { "length": 2230.0, "function_hash": "275476755045058195240646154346018295120" }, "target": { "file": "net/ipv6/ip6_offload.c", "function": "ipv6_gso_segment" }, "id": "CVE-2025-38572-f6228ad0", "signature_version": "v1" } ]