In the Linux kernel, the following vulnerability has been resolved:
ipv6: reject malicious packets in ipv6gsosegment()
syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header.
This 16bit field has a limited range.
Add skbresettransportheadercareful() helper and use it from ipv6gsosegment()
WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skbresettransportheader include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6gsosegment+0x15e2/0x21e0 net/ipv6/ip6offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skbresettransportheader include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6gsosegment+0x15e2/0x21e0 net/ipv6/ip6offload.c:151 Call Trace: <TASK> skbmacgsosegment+0x31c/0x640 net/core/gso.c:53 nshgsosegment+0x54a/0xe10 net/nsh/nsh.c:110 skbmacgsosegment+0x31c/0x640 net/core/gso.c:53 _skbgsosegment+0x342/0x510 net/core/gso.c:124 skbgsosegment include/net/gso.h:83 [inline] validatexmitskb+0x857/0x11b0 net/core/dev.c:3950 validatexmitskblist+0x84/0x120 net/core/dev.c:4000 schdirectxmit+0xd3/0x4b0 net/sched/schgeneric.c:329 _devxmitskb net/core/dev.c:4102 [inline] _devqueue_xmit+0x17b6/0x3a70 net/core/dev.c:4679
[
{
"id": "CVE-2025-38572-0d197b83",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de322cdf600fc9433845a9e944d1ca6b31cfb67e",
"target": {
"file": "net/ipv6/ip6_offload.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"281983563305516826177984576477407539008",
"244998937363614261925296960635348597956",
"278246679188240298942350968909082322194",
"201945252829398697221870858388886781519"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-30f9c725",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d45cf1e7d7180256e17c9ce88e32e8061a7887fe",
"target": {
"file": "net/ipv6/ip6_offload.c",
"function": "ipv6_gso_segment"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2230.0,
"function_hash": "275476755045058195240646154346018295120"
}
},
{
"id": "CVE-2025-38572-3ba49cf5",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de322cdf600fc9433845a9e944d1ca6b31cfb67e",
"target": {
"file": "net/ipv6/ip6_offload.c",
"function": "ipv6_gso_segment"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2576.0,
"function_hash": "268911587904003549672815998889494808781"
}
},
{
"id": "CVE-2025-38572-45b4f0a6",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5dc60b2a00ed7629214ac0c48e43f40af2078703",
"target": {
"file": "include/linux/skbuff.h"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"53715169304794543804023386804095174425",
"270137694372375286778598391762564546953",
"228235940959050524720378253983283968900"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-4a5e25ed",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee851768e4b8371ce151fd446d24bf3ae2d18789",
"target": {
"file": "net/ipv6/ip6_offload.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"281983563305516826177984576477407539008",
"244998937363614261925296960635348597956",
"278246679188240298942350968909082322194",
"201945252829398697221870858388886781519"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-5545e68b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d45cf1e7d7180256e17c9ce88e32e8061a7887fe",
"target": {
"file": "include/linux/skbuff.h"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"62288323434459823463394603743727304737",
"252051130923495420802025930572194816100",
"228235940959050524720378253983283968900"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-5e9a97d5",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09ff062b89d8e48165247d677d1ca23d6d607e9b",
"target": {
"file": "net/ipv6/ip6_offload.c",
"function": "ipv6_gso_segment"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2160.0,
"function_hash": "21216347138995156150031372692609368324"
}
},
{
"id": "CVE-2025-38572-654920da",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5dc60b2a00ed7629214ac0c48e43f40af2078703",
"target": {
"file": "net/ipv6/ip6_offload.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"281983563305516826177984576477407539008",
"244998937363614261925296960635348597956",
"278246679188240298942350968909082322194",
"201945252829398697221870858388886781519"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-782f9520",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee851768e4b8371ce151fd446d24bf3ae2d18789",
"target": {
"file": "net/ipv6/ip6_offload.c",
"function": "ipv6_gso_segment"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2230.0,
"function_hash": "275476755045058195240646154346018295120"
}
},
{
"id": "CVE-2025-38572-7be3ec06",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee851768e4b8371ce151fd446d24bf3ae2d18789",
"target": {
"file": "include/linux/skbuff.h"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"62288323434459823463394603743727304737",
"252051130923495420802025930572194816100",
"228235940959050524720378253983283968900"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-8fa93c59",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@573b8250fc2554761db3bc2bbdbab23789d52d4e",
"target": {
"file": "net/ipv6/ip6_offload.c",
"function": "ipv6_gso_segment"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2230.0,
"function_hash": "275476755045058195240646154346018295120"
}
},
{
"id": "CVE-2025-38572-962b486d",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d45cf1e7d7180256e17c9ce88e32e8061a7887fe",
"target": {
"file": "net/ipv6/ip6_offload.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"281983563305516826177984576477407539008",
"244998937363614261925296960635348597956",
"278246679188240298942350968909082322194",
"201945252829398697221870858388886781519"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-a3143278",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05007b403dcc21e701cb1f30d4572ac0a9da20",
"target": {
"file": "net/ipv6/ip6_offload.c",
"function": "ipv6_gso_segment"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2230.0,
"function_hash": "275476755045058195240646154346018295120"
}
},
{
"id": "CVE-2025-38572-a3c53eea",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f638e0b28bde7c3354a0df938ab3a96739455d1",
"target": {
"file": "net/ipv6/ip6_offload.c",
"function": "ipv6_gso_segment"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2160.0,
"function_hash": "21216347138995156150031372692609368324"
}
},
{
"id": "CVE-2025-38572-a76de7fe",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5dc60b2a00ed7629214ac0c48e43f40af2078703",
"target": {
"file": "net/ipv6/ip6_offload.c",
"function": "ipv6_gso_segment"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2160.0,
"function_hash": "21216347138995156150031372692609368324"
}
},
{
"id": "CVE-2025-38572-a9f3e7b2",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@de322cdf600fc9433845a9e944d1ca6b31cfb67e",
"target": {
"file": "include/linux/skbuff.h"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"53715169304794543804023386804095174425",
"270137694372375286778598391762564546953",
"228235940959050524720378253983283968900"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-c19c43bd",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5489e7fc6f8be3062f8cb7e49406de4bfd94db67",
"target": {
"file": "include/linux/skbuff.h"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"53715169304794543804023386804095174425",
"270137694372375286778598391762564546953",
"228235940959050524720378253983283968900"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-cddfeb24",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@573b8250fc2554761db3bc2bbdbab23789d52d4e",
"target": {
"file": "include/linux/skbuff.h"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"62288323434459823463394603743727304737",
"252051130923495420802025930572194816100",
"228235940959050524720378253983283968900"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-d8d4f3d5",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@573b8250fc2554761db3bc2bbdbab23789d52d4e",
"target": {
"file": "net/ipv6/ip6_offload.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"281983563305516826177984576477407539008",
"244998937363614261925296960635348597956",
"278246679188240298942350968909082322194",
"201945252829398697221870858388886781519"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-dd1f0ca4",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05007b403dcc21e701cb1f30d4572ac0a9da20",
"target": {
"file": "net/ipv6/ip6_offload.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"281983563305516826177984576477407539008",
"244998937363614261925296960635348597956",
"278246679188240298942350968909082322194",
"201945252829398697221870858388886781519"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-e06b4d02",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f638e0b28bde7c3354a0df938ab3a96739455d1",
"target": {
"file": "include/linux/skbuff.h"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"53715169304794543804023386804095174425",
"270137694372375286778598391762564546953",
"228235940959050524720378253983283968900"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-e5cb30fe",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f638e0b28bde7c3354a0df938ab3a96739455d1",
"target": {
"file": "net/ipv6/ip6_offload.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"281983563305516826177984576477407539008",
"244998937363614261925296960635348597956",
"278246679188240298942350968909082322194",
"201945252829398697221870858388886781519"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-e6991537",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05007b403dcc21e701cb1f30d4572ac0a9da20",
"target": {
"file": "include/linux/skbuff.h"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"53715169304794543804023386804095174425",
"270137694372375286778598391762564546953",
"228235940959050524720378253983283968900"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-e7c1f75b",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5489e7fc6f8be3062f8cb7e49406de4bfd94db67",
"target": {
"file": "net/ipv6/ip6_offload.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"281983563305516826177984576477407539008",
"244998937363614261925296960635348597956",
"278246679188240298942350968909082322194",
"201945252829398697221870858388886781519"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-eb92c4b3",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09ff062b89d8e48165247d677d1ca23d6d607e9b",
"target": {
"file": "include/linux/skbuff.h"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"53715169304794543804023386804095174425",
"270137694372375286778598391762564546953",
"228235940959050524720378253983283968900"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-ee58bffa",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@09ff062b89d8e48165247d677d1ca23d6d607e9b",
"target": {
"file": "net/ipv6/ip6_offload.c"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"281983563305516826177984576477407539008",
"244998937363614261925296960635348597956",
"278246679188240298942350968909082322194",
"201945252829398697221870858388886781519"
],
"threshold": 0.9
}
},
{
"id": "CVE-2025-38572-f6228ad0",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5489e7fc6f8be3062f8cb7e49406de4bfd94db67",
"target": {
"file": "net/ipv6/ip6_offload.c",
"function": "ipv6_gso_segment"
},
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2230.0,
"function_hash": "275476755045058195240646154346018295120"
}
}
]