In the Linux kernel, the following vulnerability has been resolved:
ipv6: reject malicious packets in ipv6gsosegment()
syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header.
This 16bit field has a limited range.
Add skbresettransportheadercareful() helper and use it from ipv6gsosegment()
WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skbresettransportheader include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6gsosegment+0x15e2/0x21e0 net/ipv6/ip6offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skbresettransportheader include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6gsosegment+0x15e2/0x21e0 net/ipv6/ip6offload.c:151 Call Trace: <TASK> skbmacgsosegment+0x31c/0x640 net/core/gso.c:53 nshgsosegment+0x54a/0xe10 net/nsh/nsh.c:110 skbmacgsosegment+0x31c/0x640 net/core/gso.c:53 _skbgsosegment+0x342/0x510 net/core/gso.c:124 skbgsosegment include/net/gso.h:83 [inline] validatexmitskb+0x857/0x11b0 net/core/dev.c:3950 validatexmitskblist+0x84/0x120 net/core/dev.c:4000 schdirectxmit+0xd3/0x4b0 net/sched/schgeneric.c:329 _devxmitskb net/core/dev.c:4102 [inline] _devqueue_xmit+0x17b6/0x3a70 net/core/dev.c:4679
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05007b403dcc21e701cb1f30d4572ac0a9da20",
"signature_version": "v1",
"id": "CVE-2025-38572-a3143278",
"signature_type": "Function",
"digest": {
"function_hash": "275476755045058195240646154346018295120",
"length": 2230.0
},
"deprecated": false,
"target": {
"function": "ipv6_gso_segment",
"file": "net/ipv6/ip6_offload.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05007b403dcc21e701cb1f30d4572ac0a9da20",
"signature_version": "v1",
"id": "CVE-2025-38572-dd1f0ca4",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"281983563305516826177984576477407539008",
"244998937363614261925296960635348597956",
"278246679188240298942350968909082322194",
"201945252829398697221870858388886781519"
]
},
"deprecated": false,
"target": {
"file": "net/ipv6/ip6_offload.c"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05007b403dcc21e701cb1f30d4572ac0a9da20",
"signature_version": "v1",
"id": "CVE-2025-38572-e6991537",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"53715169304794543804023386804095174425",
"270137694372375286778598391762564546953",
"228235940959050524720378253983283968900"
]
},
"deprecated": false,
"target": {
"file": "include/linux/skbuff.h"
}
}
]