CVE-2025-39702

ipv6: sr: Fix MAC comparison to be constant-time

State: Published
Severity: 9.8 Critical
Published: Sep 5, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: sr: Fix MAC comparison to be constant-time

To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	bf355b8d2c30a289232042cacc1cfaea4923936c to before ff55a452d56490047f5233cc48c5d933f8586884Affected bf355b8d2c30a289232042cacc1cfaea4923936c to before 3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0Affected bf355b8d2c30a289232042cacc1cfaea4923936c to before 86b6d34717fe0570afce07ee79b8eeb40341f831Affected bf355b8d2c30a289232042cacc1cfaea4923936c to before 3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3Affected bf355b8d2c30a289232042cacc1cfaea4923936c to before b3967c493799e63f648e9c7b6cb063aa2aed04e7Affected bf355b8d2c30a289232042cacc1cfaea4923936c to before f7878d47560d61e3f370aca3cebb8f42a55b990aAffected bf355b8d2c30a289232042cacc1cfaea4923936c to before a458b2902115b26a25d67393b12ddd57d1216aaaAffected
LinuxLinux	4.10Affected before 4.10Not affected 5.10.249 through 5.10.Not affected 5.15.190 through 5.15.Not affected 6.1.149 through 6.1.Not affected 6.6.103 through 6.6.Not affected 6.12.44 through 6.12.Not affected 6.16.4 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

bf355b8d2c30a289232042cacc1cfaea4923936c to before ff55a452d56490047f5233cc48c5d933f8586884Affected
bf355b8d2c30a289232042cacc1cfaea4923936c to before 3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0Affected
bf355b8d2c30a289232042cacc1cfaea4923936c to before 86b6d34717fe0570afce07ee79b8eeb40341f831Affected
bf355b8d2c30a289232042cacc1cfaea4923936c to before 3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3Affected
bf355b8d2c30a289232042cacc1cfaea4923936c to before b3967c493799e63f648e9c7b6cb063aa2aed04e7Affected
bf355b8d2c30a289232042cacc1cfaea4923936c to before f7878d47560d61e3f370aca3cebb8f42a55b990aAffected
bf355b8d2c30a289232042cacc1cfaea4923936c to before a458b2902115b26a25d67393b12ddd57d1216aaaAffected

LinuxLinux

4.10Affected
before 4.10Not affected
5.10.249 through 5.10.*Not affected
5.15.190 through 5.15.*Not affected
6.1.149 through 6.1.*Not affected
6.6.103 through 6.6.*Not affected
6.12.44 through 6.12.*Not affected
6.16.4 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.