net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2025-21629
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-01-15 13:15:15 UTC
Updated2026-07-30 06:16:31 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets The blamed commit disabled hardware offoad of IPv6 packets with extension headers on devices that advertise NETIF_F_IPV6_CSUM, based on the definition of that feature in skbuff.h: * * - %NETIF_F_IPV6_CSUM * - Driver (device) is only able to checksum plain * TCP or UDP packets over IPv6. These are specifically * unencapsulated packets of the form IPv6|TCP or * IPv6|UDP where the Next Header field in the IPv6 * header is either TCP or UDP. IPv6 extension headers * are not supported with this feature. This feature * cannot be set in features for a device with * NETIF_F_HW_CSUM also set. This feature is being * DEPRECATED (see below). The change causes skb_warn_bad_offload to fire for BIG TCP packets. [ 496.310233] WARNING: CPU: 13 PID: 23472 at net/core/dev.c:3129 skb_warn_bad_offload+0xc4/0xe0 [ 496.310297] ? skb_warn_bad_offload+0xc4/0xe0 [ 496.310300] skb_checksum_help+0x129/0x1f0 [ 496.310303] skb_csum_hwoffload_help+0x150/0x1b0 [ 496.310306] validate_xmit_skb+0x159/0x270 [ 496.310309] validate_xmit_skb_list+0x41/0x70 [ 496.310312] sch_direct_xmit+0x5c/0x250 [ 496.310317] __qdisc_run+0x388/0x620 BIG TCP introduced an IPV6_TLV_JUMBO IPv6 extension header to communicate packet length, as this is an IPv6 jumbogram. But, the feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump, and not transmitted by physical devices. For this specific case of extension headers that are not transmitted, return to the situation before the blamed commit and support hardware offload. ipv6_has_hopopt_jumbo() tests not only whether this header is present, but also that it is the only extension header before a terminal (L4) header.

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: NVD-CWE-noinfo

VersionSourceTypeScoreSeverityVector
3.1[email protected]Primary5.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary8.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
3.1CNADECLARED8.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected a84978a9cda68f0afe3f01d476c68db21526baf1 ac9cfef69565021c9e1022a493a9c40b03e2caf9 git Not specified
CNA Linux Linux affected c69bc67c1cb211aa390bea6e512bb01b1241fefb 95ccf006bbc8b59044313b8c309dcf29c546abd4 git Not specified
CNA Linux Linux affected 04c20a9356f283da623903e81e7c6d5df7e4dc3c d3b7a9c7597b779039a51d7b34116fbe424bf2b7 git Not specified
CNA Linux Linux affected 04c20a9356f283da623903e81e7c6d5df7e4dc3c 68e068cabd2c6c533ef934c2e5151609cf6ecc6d git Not specified
CNA Linux Linux affected bcefc3cd7f592a70fcbbbfd7ad1fbc69172ea78b git Not specified
CNA Linux Linux affected 477b35d94a21530046fe91589960732fcf2b29ed git Not specified
CNA Linux Linux affected a27a5c40ee4cbe00294e2c76160de5f2589061ba git Not specified
CNA Linux Linux affected 9f605135a5c0fe614c2b15197b9ced1e217eca59 git Not specified
CNA Linux Linux affected 705350fbd6ed4b5d89ee045fa57a0594a72b17d7 git Not specified
CNA Linux Linux affected 6.1.116 6.1.124 semver Not specified
CNA Linux Linux affected 6.6.60 6.6.70 semver Not specified
CNA Linux Linux affected 4.19.323 4.20 semver Not specified
CNA Linux Linux affected 5.4.285 5.5 semver Not specified
CNA Linux Linux affected 5.10.229 5.11 semver Not specified
CNA Linux Linux affected 5.15.171 5.16 semver Not specified
CNA Linux Linux affected 6.11.7 6.12 semver Not specified
CNA Linux Linux affected 6.12 Not specified
CNA Linux Linux unaffected 6.12 semver Not specified
CNA Linux Linux unaffected 6.1.124 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.70 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.9 6.12.* semver Not specified
CNA Linux Linux unaffected 6.13 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/d3b7a9c7597b779039a51d7b34116fbe424bf2b7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/68e068cabd2c6c533ef934c2e5151609cf6ecc6d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/ac9cfef69565021c9e1022a493a9c40b03e2caf9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
lists.debian.org/debian-lts-announce/2025/03/msg00001.html af854a3a-2127-422b-91ae-364da2661108 lists.debian.org
git.kernel.org/stable/c/95ccf006bbc8b59044313b8c309dcf29c546abd4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report