Security readout for executives and security teams
Plain-English summary
Linux compared authentication codes in IPv6 Segment Routing using a method whose execution time could vary. An attacker might use those timing differences to weaken authentication. The issue carries a critical 9.8 score, although the supplied sources do not demonstrate full system compromise or establish practical exploitation conditions.
Executive priority
Expedite inventory and vendor-backed patching for exposed network infrastructure using Linux IPv6 Segment Routing. The critical score warrants urgency, but practical exploitability, affected version boundaries, and real-world impact remain insufficiently documented in the supplied evidence.
Technical view
CVE-2025-39702 affects MAC verification in the Linux kernel's IPv6 Segment Routing code. The resolved implementation uses a constant-time comparison helper to prevent timing leakage. The supplied version data spans multiple kernel branches but is ambiguously encoded, so distribution-specific advisories should determine whether a deployed kernel contains the correction.
Likely exposure
Potential exposure exists on affected Linux systems using IPv6 Segment Routing MAC validation, particularly network infrastructure processing untrusted traffic. The bundle lists versions from 4.10 through several later branches, but does not provide sufficiently clear ranges for reliable version-only classification.
Exploitation context
The bundle reports that this CVE is not in KEV and provides no cited evidence of active exploitation. Exploitation is therefore unconfirmed. Timing attacks can also depend on network conditions, repeated observations, and the precise deployment configuration; those prerequisites are not established here.
Researcher notes
The CVE description establishes non-constant-time MAC comparison and its correction, but provides no attack measurements, affected function details, proof of concept, or demonstrated confidentiality, integrity, and availability impact. The 9.8 vector therefore appears stronger than the technical evidence included here; further vendor analysis is needed.
Mitigation direction
- Inventory Linux systems and appliances using IPv6 Segment Routing functionality.
- Apply a vendor-supported kernel containing the referenced constant-time MAC comparison correction.
- Consult distribution and appliance advisories for exact fixed package versions.
- Request vendor guidance on interim mitigations where immediate kernel updates are impractical.
Validation and detection
- Record each relevant system's running kernel and vendor package version.
- Confirm vendor changelogs map the installed package to the referenced correction.
- Verify systems booted into the updated kernel after maintenance.
- Review Debian and Siemens advisories where those products or packages are deployed.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39702 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ff55a452d56490047f5233cc48c5d933f8586884CVE reference, Linux
- https://git.kernel.org/stable/c/3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0CVE reference, Linux
- https://git.kernel.org/stable/c/86b6d34717fe0570afce07ee79b8eeb40341f831CVE reference, Linux
- https://git.kernel.org/stable/c/3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3CVE reference, Linux
- https://git.kernel.org/stable/c/b3967c493799e63f648e9c7b6cb063aa2aed04e7CVE reference, Linux
- https://git.kernel.org/stable/c/f7878d47560d61e3f370aca3cebb8f42a55b990aCVE reference, Linux
- https://git.kernel.org/stable/c/a458b2902115b26a25d67393b12ddd57d1216aaaCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.