Executive brief
A security vulnerability has been identified in the Linux kernel's networking component that handles IPv6 Segment Routing. The system was using a non-secure method to compare security codes (MACs), which could allow an attacker to guess valid codes by measuring how long the system takes to respond. If successfully exploited, this could allow an attacker to bypass security checks, potentially leading to unauthorized data access or disruption of network services.
Technical details
A timing side-channel vulnerability exists in 'net/ipv6/seg6_hmac.c' within the Linux kernel. The function 'seg6_hmac_validate_skb' used 'memcmp()' to validate HMACs in IPv6 Segment Routing headers, which returns early upon finding a mismatch. This observable discrepancy in execution time (CWE-203) allows a remote attacker to perform a timing attack to forge valid HMACs. The fix replaces 'memcmp()' with 'crypto_memneq()', ensuring constant-time comparison. Patches have been backported to multiple stable kernel branches including 5.10, 5.15, 6.1, 6.6, and 6.12.
Affected products
- Linux Linux Kernel 4.10 to 6.16.4
- Siemens SIMATIC CN 4100 before V5.0
Timeline
- 2025-08-18: patched: Initial patch authored by Eric Biggers
- 2025-09-05: disclosed: CVE published
References
- https://git.kernel.org/stable/c/3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0
- https://git.kernel.org/stable/c/3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3
- https://git.kernel.org/stable/c/86b6d34717fe0570afce07ee79b8eeb40341f831
- https://git.kernel.org/stable/c/a458b2902115b26a25d67393b12ddd57d1216aaa
- https://git.kernel.org/stable/c/b3967c493799e63f648e9c7b6cb063aa2aed04e7
- https://git.kernel.org/stable/c/f7878d47560d61e3f370aca3cebb8f42a55b990a
- https://git.kernel.org/stable/c/ff55a452d56490047f5233cc48c5d933f8586884