# CVE-2025-39703: Linux kernel denial of service in HSR frame processing

Source: https://junglewise.ai/threats/cve-2025-39703-linux-kernel-denial-of-service-in-hsr-frame-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-05. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2025-39703 · Severity: critical · CVSS 9.8 · Published 2025-09-05

A vulnerability in the Linux kernel's High-availability Seamless Redundancy (HSR) networking component can cause a complete system crash. HSR is a protocol used to ensure reliable communication in industrial and critical infrastructure networks. By sending a specially crafted or corrupted network packet, an attacker could trigger a kernel panic, leading to a denial of service that disrupts operations and network availability.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Siemens SIMATIC CN 4100](https://junglewise.ai/threats/technologies/simatic-cn-4100). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-39703 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-39703 being exploited in the wild.

**How severe is CVE-2025-39703?** Critical severity, with a CVSS score of 9.8, published 5 September 2025.

**Which products and versions are affected?** Linux Kernel 5.10.42 to 5.10.241, 5.12.9 to 5.13, 5.13.1 to 5.15.190, 5.16 to 6.1.149, 6.2 to 6.6.103, 6.7 to 6.12.44, 6.13 to 6.16.4; Siemens SIMATIC CN 4100 before V5.0.

**Is there a fix for CVE-2025-39703?** A patch was published on 2025-08-28: Patches committed to Linux stable trees Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-39703 attacked?** It is attacked over the network or from the adjacent network or with local access, in an operating system.

**Am I affected by CVE-2025-39703?** Check whether you run Linux Kernel or Siemens SIMATIC CN 4100 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the Linux kernel's net/hsr component where receiving a corrupted HSR frame with insufficient space to hold the HSR tag in the socket buffer (skb) results in a kernel BUG (skb_under_panic). The root cause is in hsr_handle_frame(), which calls skb_set_network_header() without verifying the skb length, leading to incorrect mac_len and network_header offsets. This corruption propagates through hsr_forward_skb() and create_stripped_skb_hsr(), eventually causing a panic in br_dev_queue_push_xmit() when it attempts an skb_push() with insufficient headroom. The vulnerability can be exploited via AF_PACKET or potentially via adjacent network traffic. Patches have been released for multiple stable kernel branches to drop frames that cannot contain both Ethernet and HSR headers.

## Affected products

- Linux Linux Kernel 6.15.0, 6.1.y, 6.6.y, 6.10.y, 6.11.y, 6.12.y, 6.13.y, 6.14.y
- Siemens SIMATIC CN 4100 before V5.0

## Timeline

- 2025-08-19: disclosed: Vulnerability identified and patch authored by Jakub Acs
- 2025-08-28: patched: Patches committed to Linux stable trees
- 2025-09-05: advisory: CVE-2025-39703 published in NVD

## References

- [https://git.kernel.org/stable/c/3ae272ab523dd6bdc26e879027ed79feac9dd1b3](https://git.kernel.org/stable/c/3ae272ab523dd6bdc26e879027ed79feac9dd1b3)
- [https://git.kernel.org/stable/c/61009439e4bd8d74e705ee15940760321be91d8a](https://git.kernel.org/stable/c/61009439e4bd8d74e705ee15940760321be91d8a)
- [https://git.kernel.org/stable/c/7af76e9d18a9fd6f8611b3313c86c190f9b6a5a7](https://git.kernel.org/stable/c/7af76e9d18a9fd6f8611b3313c86c190f9b6a5a7)
- [https://git.kernel.org/stable/c/8d9bc4a375a1ba05f7dfa0407de8e510ab9bd14d](https://git.kernel.org/stable/c/8d9bc4a375a1ba05f7dfa0407de8e510ab9bd14d)
- [https://git.kernel.org/stable/c/acd69b597bd3f76d3b3d322b84082226c00eeaa4](https://git.kernel.org/stable/c/acd69b597bd3f76d3b3d322b84082226c00eeaa4)
- [https://git.kernel.org/stable/c/b117c41b00902c1a7e24347c405cb82504aeae0b](https://git.kernel.org/stable/c/b117c41b00902c1a7e24347c405cb82504aeae0b)
- [https://git.kernel.org/stable/c/b640188b8a6690e685939053c7efdbc7818b5f4e](https://git.kernel.org/stable/c/b640188b8a6690e685939053c7efdbc7818b5f4e)

## Related threats

- [Linux kernel xen-netback double unmap memory corruption](https://junglewise.ai/threats/cve-2026-99287-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel PMC uninitialized clock rate in 32-bit Tegra](https://junglewise.ai/threats/cve-2026-99259-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel x86 Hyper-V memory access violation](https://junglewise.ai/threats/cve-2026-99258-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel io_uring signal loss in worker exit](https://junglewise.ai/threats/cve-2026-99228-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel mv643xx_eth NULL pointer dereference in PHY probe](https://junglewise.ai/threats/cve-2026-99197-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)