Security readout for executives and security teams
Plain-English summary
A Linux networking flaw can sharply reduce throughput when IPv6 packets with extension headers are processed through certain hardware checksum-offload configurations. GRE-over-IPv6 tunnels are a cited example. The documented impact is service availability and performance, not data theft or modification.
Executive priority
Prioritize internet-facing gateways, tunnel endpoints, appliances, and high-availability systems using IPv6 extension headers. Treat this as an urgent availability remediation where the relevant traffic and offload conditions exist. For other Linux assets, complete inventory and vendor-version mapping before assigning emergency priority.
Technical view
IPv6 GSO incorrectly retains NETIF_F_IPV6_CSUM for extension-header packets even though that feature supports only plain TCP or UDP over IPv6. Unsupported checksum offload can trigger skb_warn_bad_offload and throughput collapse. The correction masks IPV6_CSUM, TSO6, and GSO_UDP_L4 so checksums are computed in software, preserving the documented BIG TCP exception.
Likely exposure
Exposure is concentrated in Linux systems transmitting IPv6 extension-header traffic through devices advertising only NETIF_F_IPV6_CSUM, particularly GRE-over-IPv6 configurations. Ordinary hosts not using this traffic and offload combination may never encounter the fault. The supplied version data is ambiguous, so exact exposure requires build-level vendor verification.
Exploitation context
The supplied CVSS 3.1 score is 7.5, reflecting network-reachable, unauthenticated availability impact. However, the bundle marks the CVE as absent from KEV and provides no evidence of active exploitation or a public exploit. The documented outcome is warning generation and throughput collapse; practical trigger conditions depend on networking configuration.
Researcher notes
The failure is a feature-contract violation between GSO and device checksum offload. The source bundle lists affected and unaffected versions in a form that appears commit-oriented and potentially inconsistent, so avoid broad version conclusions. Validate exact vendor builds, driver features, extension-header presence, warning telemetry, and whether the cited feature-masking change is present.
Mitigation direction
- Inventory systems processing IPv6 extension-header traffic, especially GRE-over-IPv6 tunnels.
- Apply the relevant Linux stable or distribution kernel update containing the cited correction.
- Activate the updated kernel according to distribution or appliance-vendor guidance.
- If patching is delayed, consult vendor guidance; the supplied sources identify no validated workaround.
Validation and detection
- Map each running kernel build to a fixed vendor advisory or cited stable commit.
- Identify egress devices advertising NETIF_F_IPV6_CSUM and workloads using IPv6 extension headers.
- Monitor kernel logs for skb_warn_bad_offload during representative legitimate traffic.
- Compare tunnel throughput before and after remediation in a controlled environment.
- Verify gso_features_check applies the documented feature masks while retaining the BIG TCP exception.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39770 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a0478d7e888028f85fa7785ea838ce0ca09398e2CVE reference, Linux
- https://git.kernel.org/stable/c/2156d9e9f2e483c8c3906c0ea57ea312c1424235CVE reference, Linux
- https://git.kernel.org/stable/c/041e2f945f82fdbd6fff577b79c33469430297aaCVE reference, Linux
- https://git.kernel.org/stable/c/794ddbb7b63b6828c75967b9bcd43b086716e7a1CVE reference, Linux
- https://git.kernel.org/stable/c/864e3396976ef41de6cc7bc366276bf4e084fff2CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.htmlCVE reference, CVE
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-032379.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.