CVE-2025-39703: Linux kernel denial of service in HSR frame processing

CVE-2025-39703 · Severity: critical · CVSS 9.8 · Published 2025-09-05

A vulnerability in the Linux kernel's High-availability Seamless Redundancy (HSR) networking component can cause a complete system crash. HSR is a protocol used to ensure reliable communication in industrial and critical infrastructure networks. By sending a specially crafted or corrupted network packet, an attacker could trigger a kernel panic, leading to a denial of service that disrupts operations and network availability.

Technologies: Linux Kernel, Siemens SIMATIC CN 4100. Vendors: Linux, Siemens.

Quick answers

Is CVE-2025-39703 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-39703 being exploited in the wild.
How severe is CVE-2025-39703?
Critical severity, with a CVSS score of 9.8, published 5 September 2025.
Which products and versions are affected?
Linux Kernel 5.10.42 to 5.10.241, 5.12.9 to 5.13, 5.13.1 to 5.15.190, 5.16 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4; Siemens SIMATIC CN 4100 before V5.0.
Is there a fix for CVE-2025-39703?
A patch was published on 2025-08-28: Patches committed to Linux stable trees Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-39703 attacked?
It is attacked over the network or from the adjacent network or with local access, in an operating system.
Am I affected by CVE-2025-39703?
Check whether you run Linux Kernel or Siemens SIMATIC CN 4100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Linux kernel's net/hsr component where receiving a corrupted HSR frame with insufficient space to hold the HSR tag in the socket buffer (skb) results in a kernel BUG (skb_under_panic). The root cause is in hsr_handle_frame(), which calls skb_set_network_header() without verifying the skb length, leading to incorrect mac_len and network_header offsets. This corruption propagates through hsr_forward_skb() and create_stripped_skb_hsr(), eventually causing a panic in br_dev_queue_push_xmit() when it attempts an skb_push() with insufficient headroom. The vulnerability can be exploited via AF_PACKET or potentially via adjacent network traffic. Patches have been released for multiple stable kernel branches to drop frames that cannot contain both Ethernet and HSR headers.

Affected products

  • Linux Linux Kernel 6.15.0, 6.1.y, 6.6.y, 6.10.y, 6.11.y, 6.12.y, 6.13.y, 6.14.y
  • Siemens SIMATIC CN 4100 before V5.0

Timeline

  • 2025-08-19: disclosed: Vulnerability identified and patch authored by Jakub Acs
  • 2025-08-28: patched: Patches committed to Linux stable trees
  • 2025-09-05: advisory: CVE-2025-39703 published in NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.