LiveActive security incident?Get immediate response
CVE Record

CVE-2025-21629: net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets

In the Linux kernel, the following vulnerability has been resolved: net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets The blamed commit disabled hardware offoad of IPv6 packets with extension headers on devices that advertise NETIF_F_IPV6_CSUM, based on the definition of that feature in skbuff.h: * * - %NETIF_F_IPV6_CSUM * - Driver (device) is only able to checksum plain * TCP or UDP packets over IPv6. These are specifically * unencapsulated packets of the form IPv6|TCP or * IPv6|UDP where the Next Header field in the IPv6 * header is either TCP or UDP. IPv6 extension headers * are not supported with this feature. This feature * cannot be set in features for a device with * NETIF_F_HW_CSUM also set. This feature is being * DEPRECATED (see below). The change causes skb_warn_bad_offload to fire for BIG TCP packets. [ 496.310233] WARNING: CPU: 13 PID: 23472 at net/core/dev.c:3129 skb_warn_bad_offload+0xc4/0xe0 [ 496.310297] ? skb_warn_bad_offload+0xc4/0xe0 [ 496.310300] skb_checksum_help+0x129/0x1f0 [ 496.310303] skb_csum_hwoffload_help+0x150/0x1b0 [ 496.310306] validate_xmit_skb+0x159/0x270 [ 496.310309] validate_xmit_skb_list+0x41/0x70 [ 496.310312] sch_direct_xmit+0x5c/0x250 [ 496.310317] __qdisc_run+0x388/0x620 BIG TCP introduced an IPV6_TLV_JUMBO IPv6 extension header to communicate packet length, as this is an IPv6 jumbogram. But, the feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump, and not transmitted by physical devices. For this specific case of extension headers that are not transmitted, return to the situation before the blamed commit and support hardware offload. ipv6_has_hopopt_jumbo() tests not only whether this header is present, but also that it is the only extension header before a terminal (L4) header.

HighCVSS 8.2Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux networking regression mishandles checksum offload for IPv6 BIG TCP packets carrying a jumbo extension header, triggering a kernel bad-offload warning. The supplied CVSS rates it 8.2 because remote, unauthenticated traffic may cause major availability impact and limited confidentiality impact. The technical narrative does not establish the exact failure outcome.

Executive priority

Use accelerated patching for systems meeting the BIG TCP and offload prerequisites, especially availability-sensitive network infrastructure. The high CVSS score warrants attention, but the absence of cited active exploitation and incomplete impact narrative do not support emergency incident assumptions. Confirm exposure before broad operational changes.

Technical view

A prior change disabled NETIF_F_IPV6_CSUM offload when IPv6 extension headers appeared. BIG TCP adds IPV6_TLV_JUMBO for length accounting, but this header is visible only to PF_PACKET taps and is not physically transmitted. On BIG TCP TSO-capable devices, the mismatch reaches the transmit validation path and fires skb_warn_bad_offload. Stable fixes selectively restore hardware offload.

Likely exposure

Exposure is most plausible on affected Linux builds using IPv6 BIG TCP with BIG TCP TSO-capable network devices and relevant checksum offload. Hosts without that feature combination may not reach the path. The flattened version data does not clearly distinguish every vulnerable-to-fixed boundary; validate distribution packages against vendor mappings and the cited stable fixes.

Exploitation context

KEV is false, and the supplied sources provide no evidence of active exploitation or a public exploit. The CVSS vector indicates network reachability, low complexity, no privileges, and no user interaction; environmental BIG TCP and offload prerequisites still apply. Exploitation status is unconfirmed, not proven absent.

Researcher notes

The record assigns CVSS 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H), but its narrative primarily demonstrates a transmit-path kernel warning. It neither explains the confidentiality impact nor proves a remotely induced crash. The fix relies on ipv6_has_hopopt_jumbo() confirming the jumbo option is the sole extension before the terminal Layer 4 header.

Mitigation direction

  • Apply a distribution or kernel update containing the applicable cited stable fix.
  • Map distribution kernel packages to vendor CVE guidance before selecting an update.
  • If patching is delayed, consult vendor guidance before changing BIG TCP or checksum-offload settings.
  • Prioritize affected, network-facing IPv6 systems using high-throughput BIG TCP configurations.

Validation and detection

  • Confirm the running kernel build contains the applicable stable fix, not merely the installed package.
  • Inventory whether IPv6 BIG TCP, compatible TSO, and relevant checksum offload are present.
  • Review kernel logs for skb_warn_bad_offload warnings associated with IPv6 BIG TCP traffic.
  • After updating, repeat representative network regression testing and confirm the warning does not recur.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-21629 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.2 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
6Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.2CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H3.94.2Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.2High
CVSS 3.1 vector shape for CVE-2025-21629Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa84978a9cda68f0afe3f01d476c68db21526baf1, c69bc67c1cb211aa390bea6e512bb01b1241fefb, 04c20a9356f283da623903e81e7c6d5df7e4dc3c, 04c20a9356f283da623903e81e7c6d5df7e4dc3c, bcefc3cd7f592a70fcbbbfd7ad1fbc69172ea78b, 477b35d94a21530046fe91589960732fcf2b29ed, a27a5c40ee4cbe00294e2c76160de5f2589061ba, 9f605135a5c0fe614c2b15197b9ced1e217eca59, 705350fbd6ed4b5d89ee045fa57a0594a72b17d7, 6.1.116, 6.6.60, 4.19.323, 5.4.285, 5.10.229, 5.15.171, 6.11.7unaffected
LinuxLinux6.12, 0, 6.1.124, 6.6.70, 6.12.9, 6.13affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.