Executive brief
A vulnerability in the Linux kernel's network driver for STMicroelectronics Ethernet controllers could allow corrupt data packets to be processed as valid. The driver failed to check for hardware-reported errors during the packet verification process, potentially leading to data integrity issues. This affects systems using the stmmac driver, commonly found in embedded and automotive hardware.
Technical details
A vulnerability exists in the stmmac_rx function within the stmmac Ethernet driver (drivers/net/ethernet/stmicro/stmmac/stmmac_main.c). The driver previously set skb->ip_summed to CHECKSUM_UNNECESSARY based solely on the presence of hardware checksum offload (CoE) and IP ethertype, without verifying the hardware's actual checksum status. Consequently, packets with header or payload checksum failures were passed to the network stack as valid. The fix introduces a check for the 'csum_none' status flag to ensure the kernel performs its own validation when hardware reporting indicates an error. Patches have been backported to multiple stable kernel branches including 6.6.y, 6.12.y, and 6.17.y.
Affected products
- Linux Linux Kernel 3.2 to 6.6.117, 6.12.58, 6.17.8
Timeline
- 2025-08-18: disclosed: Initial patch submitted by Oleksij Rempel
- 2025-12-09: advisory: CVE-2025-40337 published by kernel.org