Is CVE-2025-39702 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-39702 being exploited in the wild.

How severe is CVE-2025-39702?

Critical severity, with a CVSS score of 9.8, published 5 September 2025.

Which products and versions are affected?

Linux Kernel 4.10 to 5.15.190, 5.16 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4, 4.10 to 6.16.4; Siemens SIMATIC CN 4100 before V5.0.

Is there a fix for CVE-2025-39702?

A patch was published on 2025-08-18: Initial patch authored by Eric Biggers Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-39702 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2025-39702?

Check whether you run Linux Kernel or Siemens SIMATIC CN 4100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-39702: Linux Kernel timing attack in IPv6 Segment Routing HMAC validation

CVE-2025-39702 · Severity: critical · CVSS 9.8 · Published 2025-09-05

A security vulnerability has been identified in the Linux kernel's networking component that handles IPv6 Segment Routing. The system was using a non-secure method to compare security codes (MACs), which could allow an attacker to guess valid codes by measuring how long the system takes to respond. If successfully exploited, this could allow an attacker to bypass security checks, potentially leading to unauthorized data access or disruption of network services.

Technologies: Linux Kernel, Siemens SIMATIC CN 4100. Vendors: Linux, Siemens.

Quick answers

Is CVE-2025-39702 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-39702 being exploited in the wild.
How severe is CVE-2025-39702?: Critical severity, with a CVSS score of 9.8, published 5 September 2025.
Which products and versions are affected?: Linux Kernel 4.10 to 5.15.190, 5.16 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4, 4.10 to 6.16.4; Siemens SIMATIC CN 4100 before V5.0.
Is there a fix for CVE-2025-39702?: A patch was published on 2025-08-18: Initial patch authored by Eric Biggers Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-39702 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2025-39702?: Check whether you run Linux Kernel or Siemens SIMATIC CN 4100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A timing side-channel vulnerability exists in 'net/ipv6/seg6_hmac.c' within the Linux kernel. The function 'seg6_hmac_validate_skb' used 'memcmp()' to validate HMACs in IPv6 Segment Routing headers, which returns early upon finding a mismatch. This observable discrepancy in execution time (CWE-203) allows a remote attacker to perform a timing attack to forge valid HMACs. The fix replaces 'memcmp()' with 'crypto_memneq()', ensuring constant-time comparison. Patches have been backported to multiple stable kernel branches including 5.10, 5.15, 6.1, 6.6, and 6.12.

Affected products

Linux Linux Kernel 4.10 to 6.16.4
Siemens SIMATIC CN 4100 before V5.0

Timeline

2025-08-18: patched: Initial patch authored by Eric Biggers
2025-09-05: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.