Junglewise Threat Intelligence

CVE-2025-39703: Linux kernel denial of service in HSR frame processing

CVE-2025-39703 · Severity: critical · CVSS 9.8 · Published 2025-09-05

Technologies: Siemens SIMATIC CN 4100, Linux Kernel. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's High-availability Seamless Redundancy (HSR) networking component can cause a complete system crash. HSR is a protocol used to ensure reliable communication in industrial and critical infrastructure networks. By sending a specially crafted or corrupted network packet, an attacker could trigger a kernel panic, leading to a denial of service that disrupts operations and network availability.

Technical details

A vulnerability exists in the Linux kernel's net/hsr component where receiving a corrupted HSR frame with insufficient space to hold the HSR tag in the socket buffer (skb) results in a kernel BUG (skb_under_panic). The root cause is in hsr_handle_frame(), which calls skb_set_network_header() without verifying the skb length, leading to incorrect mac_len and network_header offsets. This corruption propagates through hsr_forward_skb() and create_stripped_skb_hsr(), eventually causing a panic in br_dev_queue_push_xmit() when it attempts an skb_push() with insufficient headroom. The vulnerability can be exploited via AF_PACKET or potentially via adjacent network traffic. Patches have been released for multiple stable kernel branches to drop frames that cannot contain both Ethernet and HSR headers.

Affected products

  • Linux Linux Kernel 6.15.0, 6.1.y, 6.6.y, 6.10.y, 6.11.y, 6.12.y, 6.13.y, 6.14.y
  • Siemens SIMATIC CN 4100 before V5.0

Timeline

  • 2025-08-19: disclosed: Vulnerability identified and patch authored by Jakub Acs
  • 2025-08-28: patched: Patches committed to Linux stable trees
  • 2025-09-05: advisory: CVE-2025-39703 published in NVD

References

Related threats