IPv6 Checksum Offload Issue in Linux Kernel Affects Network Performance

CVE-2025-39770

What is CVE-2025-39770?

A vulnerability in the Linux kernel's handling of IPv6 packets has been identified, specifically concerning Generic Segmentation Offload (GSO) with extension headers. When the kernel processes IPv6 packets featuring extensions, it erroneously permits checksum offloading on devices that only advertise the NETIF_F_IPV6_CSUM capability. This oversight leads to a significant compatibility issue, causing warnings in the kernel log and potentially disrupting network throughput. The correct protocol requires that the GSO logic prohibits checksum offloading for packets with such extensions, helping to maintain network stability and performance.

References