CVE-2025-38572
Description
A flaw was found in the Linux kernel's IPv6 networking subsystem. A remote attacker could trigger a Denial of Service (DoS) or cause system instability by transmitting specially crafted network packets with excessively long IPv6 extension headers. During packet segmentation processing, these oversized headers cause an integer overflow when calculating internal packet offsets, which can lead to a kernel crash.
Statement
A moderate severity flaw was found in the Linux kernel's IPv6 networking subsystem, affecting the kernel in Red Hat Enterprise Linux 10. During IPv6 packet segmentation in ipv6_gso_segment(), a specially crafted network packet with excessively long IPv6 extension headers can cause the 16-bit skb->transport_header field, which stores internal packet offsets, to overflow. A remote attacker able to transmit such crafted packets could trigger this integer overflow, leading to a kernel warning or crash and resulting in a denial of service or system instability. Red Hat Enterprise Linux 10 is affected and a fix is being pursued through the standard update process. Red Hat Enterprise Linux 6 through 9 and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those products. Red Hat rates this flaw as Moderate impact, while NIST and CVE.org assign it a CVSS 3.1 score of 7.8 (Important); Red Hat's rating reflects that the flaw manifests as a denial-of-service condition triggered by crafted packets.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.4 | 7.8 | 7.8 |
| Attack Vector | Network | Local | Local |
| Attack Complexity | High | Low | Low |
| Privileges Required | None | Low | Low |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | High | High |
| Integrity Impact | High | High | High |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
