In the Linux kernel, the following vulnerability has been resolved:
ipv6: reject malicious packets in ipv6gsosegment()
syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header.
This 16bit field has a limited range.
Add skbresettransportheadercareful() helper and use it from ipv6gsosegment()
WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skbresettransportheader include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6gsosegment+0x15e2/0x21e0 net/ipv6/ip6offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skbresettransportheader include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6gsosegment+0x15e2/0x21e0 net/ipv6/ip6offload.c:151 Call Trace: <TASK> skbmacgsosegment+0x31c/0x640 net/core/gso.c:53 nshgsosegment+0x54a/0xe10 net/nsh/nsh.c:110 skbmacgsosegment+0x31c/0x640 net/core/gso.c:53 __skbgsosegment+0x342/0x510 net/core/gso.c:124 skbgsosegment include/net/gso.h:83 [inline] validatexmitskb+0x857/0x11b0 net/core/dev.c:3950 validatexmitskblist+0x84/0x120 net/core/dev.c:4000 schdirectxmit+0xd3/0x4b0 net/sched/schgeneric.c:329 __devxmitskb net/core/dev.c:4102 [inline] __devqueuexmit+0x17b6/0x3a70 net/core/dev.c:4679
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38572.json"
}[
{
"signature_type": "Function",
"deprecated": false,
"id": "CVE-2025-38572-a3143278",
"target": {
"file": "net/ipv6/ip6_offload.c",
"function": "ipv6_gso_segment"
},
"digest": {
"length": 2230.0,
"function_hash": "275476755045058195240646154346018295120"
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05007b403dcc21e701cb1f30d4572ac0a9da20"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2025-38572-dd1f0ca4",
"target": {
"file": "net/ipv6/ip6_offload.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"281983563305516826177984576477407539008",
"244998937363614261925296960635348597956",
"278246679188240298942350968909082322194",
"201945252829398697221870858388886781519"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05007b403dcc21e701cb1f30d4572ac0a9da20"
},
{
"signature_type": "Line",
"deprecated": false,
"id": "CVE-2025-38572-e6991537",
"target": {
"file": "include/linux/skbuff.h"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"53715169304794543804023386804095174425",
"270137694372375286778598391762564546953",
"228235940959050524720378253983283968900"
]
},
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef05007b403dcc21e701cb1f30d4572ac0a9da20"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38572.json"