VulnerabilityPublished 9 Dec 2025Updated 30 Oct 2026

CVE-2025-40337: Linux kernel · net: stmmac: Correctly handle Rx checksum offload errors

Affects Linux kernelSource CVE Database V5

Not known to be exploited · CVSS 8.2 High · fixed in ee0aace5f844ef59335148875d05bec8764e71e8 : patch Linux kernel soon.

Data as of 30 Oct 2026, 12:49 UTC

CVSS 3.1 base score

8.2High

How severe the flaw is on the 0–10 CVSS scale.

Thin evidence

One scorer or none

CVSS scores by source
CNA (Linux)	CVSS 3.1	8.2

Patch: Available – fixed in ee0aace5f844ef59335148875d05bec8764e71e8, 719fcdf29051f7471d5d433475af76219019d33d, 63fbe0e6413279d5ea5842e2423e351ded547683 +2

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 9 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0, < ee0aace5f844ef59335148875d05bec8764e71e8	Fixed in ee0aace5f844ef59335148875d05bec8764e71e8
LinuxLinux	Affected ≥ 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0, < 719fcdf29051f7471d5d433475af76219019d33d	Fixed in 719fcdf29051f7471d5d433475af76219019d33d
LinuxLinux	Affected ≥ 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0, < 63fbe0e6413279d5ea5842e2423e351ded547683	Fixed in 63fbe0e6413279d5ea5842e2423e351ded547683
LinuxLinux	Affected ≥ 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0, < 3c5e5fccc4138c072d99be4ebe6b16df6a70a40c	Fixed in 3c5e5fccc4138c072d99be4ebe6b16df6a70a40c
LinuxLinux	Affected ≥ 3c20f72f9108b2fcf30ec63d8a4203736c01ccd0, < 1aa319e0f12d2d761a31556b82a5852c98eb0bea	Fixed in 1aa319e0f12d2d761a31556b82a5852c98eb0bea
LinuxLinux	Affected =3.2	Fixed in–

AI-suggested

A fix is available and has been applied in the Linux kernel commits identified by the fixedVersions hashes. Users should update their Linux kernel to a version including these fixes to ensure proper handling of Rx checksum offload errors. No additional mitigation steps are indicated.

Description

CVE-2025-40337 is a high-severity vulnerability in the Linux kernel's stmmac network driver. The flaw involves incorrect handling of Rx checksum offload errors, where corrupt packets could be mistakenly treated as valid due to ignoring hardware-reported checksum failures. This issue has been fixed by updating the driver logic to properly check hardware status flags and ensure corrupt packets are validated by the kernel network stack.

Impact

This vulnerability could allow corrupt network packets to be accepted as valid by the Linux kernel network stack, potentially leading to data integrity issues or further exploitation by attackers manipulating network traffic. The CVSS score of 8.2 reflects a high severity with impact on integrity and low impact on availability. There is no indication of confidentiality impact.

Summary

The Linux kernel's stmmac_rx function incorrectly set skb->ip_summed to CHECKSUM_UNNECESSARY when hardware checksum offload was enabled and the packet was a known IP ethertype, without verifying if the hardware reported a checksum error. This oversight allowed corrupt packets with checksum errors to bypass kernel validation and be passed as valid. The patch corrects this by checking the csum_none status flag, which indicates hardware checksum errors, and sets skb->ip_summed to CHECKSUM_NONE accordingly, forcing the kernel to validate the packet checksum and handle corrupt packets properly.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 30 Oct 2026, 12:47 UTC

Technical details

References

Community reviews

Related threats