Riskcovery

CVE-2025-40337

net: stmmac: Correctly handle Rx checksum offload errors

State
Published
Severity
8.2 High
Published
Dec 9, 2025
Updated
Oct 30, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: Correctly handle Rx checksum offload errors

The stmmac_rx function would previously set skb->ip_summed to CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled and the packet was of a known IP ethertype.

However, this logic failed to check if the hardware had actually reported a checksum error. The hardware status, indicating a header or payload checksum failure, was being ignored at this stage. This could cause corrupt packets to be passed up the network stack as valid.

This patch corrects the logic by checking the `csum_none` status flag, which is set when the hardware reports a checksum error. If this flag is set, skb->ip_summed is now correctly set to CHECKSUM_NONE, ensuring the kernel's network stack will perform its own validation and properly handle the corrupt packet.

Scores

CVSSScoreVectorSource
3.18.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:LLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0 to before 3c5e5fccc4138c072d99be4ebe6b16df6a70a40cAffected
  • 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0 to before 63fbe0e6413279d5ea5842e2423e351ded547683Affected
  • 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0 to before 719fcdf29051f7471d5d433475af76219019d33dAffected
  • 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0 to before 1aa319e0f12d2d761a31556b82a5852c98eb0beaAffected
  • 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0 to before ee0aace5f844ef59335148875d05bec8764e71e8Affected
LinuxLinux
  • 3.2Affected
  • before 3.2Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.117 through 6.6.*Not affected
  • 6.12.58 through 6.12.*Not affected
  • 6.17.8 through 6.17.*Not affected
  • 6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.