| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2025-21629: net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets |
| |
| The blamed commit disabled hardware offoad of IPv6 packets with |
| extension headers on devices that advertise NETIF_F_IPV6_CSUM, |
| based on the definition of that feature in skbuff.h: |
| |
| * * - %NETIF_F_IPV6_CSUM |
| * - Driver (device) is only able to checksum plain |
| * TCP or UDP packets over IPv6. These are specifically |
| * unencapsulated packets of the form IPv6|TCP or |
| * IPv6|UDP where the Next Header field in the IPv6 |
| * header is either TCP or UDP. IPv6 extension headers |
| * are not supported with this feature. This feature |
| * cannot be set in features for a device with |
| * NETIF_F_HW_CSUM also set. This feature is being |
| * DEPRECATED (see below). |
| |
| The change causes skb_warn_bad_offload to fire for BIG TCP |
| packets. |
| |
| [ 496.310233] WARNING: CPU: 13 PID: 23472 at net/core/dev.c:3129 skb_warn_bad_offload+0xc4/0xe0 |
| |
| [ 496.310297] ? skb_warn_bad_offload+0xc4/0xe0 |
| [ 496.310300] skb_checksum_help+0x129/0x1f0 |
| [ 496.310303] skb_csum_hwoffload_help+0x150/0x1b0 |
| [ 496.310306] validate_xmit_skb+0x159/0x270 |
| [ 496.310309] validate_xmit_skb_list+0x41/0x70 |
| [ 496.310312] sch_direct_xmit+0x5c/0x250 |
| [ 496.310317] __qdisc_run+0x388/0x620 |
| |
| BIG TCP introduced an IPV6_TLV_JUMBO IPv6 extension header to |
| communicate packet length, as this is an IPv6 jumbogram. But, the |
| feature is only enabled on devices that support BIG TCP TSO. The |
| header is only present for PF_PACKET taps like tcpdump, and not |
| transmitted by physical devices. |
| |
| For this specific case of extension headers that are not |
| transmitted, return to the situation before the blamed commit |
| and support hardware offload. |
| |
| ipv6_has_hopopt_jumbo() tests not only whether this header is present, |
| but also that it is the only extension header before a terminal (L4) |
| header. |
| |
| The Linux kernel CVE team has assigned CVE-2025-21629 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 6.1.116 with commit a84978a9cda68f0afe3f01d476c68db21526baf1 and fixed in 6.1.124 with commit ac9cfef69565021c9e1022a493a9c40b03e2caf9 |
| Issue introduced in 6.6.60 with commit c69bc67c1cb211aa390bea6e512bb01b1241fefb and fixed in 6.6.70 with commit 95ccf006bbc8b59044313b8c309dcf29c546abd4 |
| Issue introduced in 6.12 with commit 04c20a9356f283da623903e81e7c6d5df7e4dc3c and fixed in 6.12.9 with commit d3b7a9c7597b779039a51d7b34116fbe424bf2b7 |
| Issue introduced in 6.12 with commit 04c20a9356f283da623903e81e7c6d5df7e4dc3c and fixed in 6.13 with commit 68e068cabd2c6c533ef934c2e5151609cf6ecc6d |
| Issue introduced in 4.19.323 with commit bcefc3cd7f592a70fcbbbfd7ad1fbc69172ea78b |
| Issue introduced in 5.4.285 with commit 477b35d94a21530046fe91589960732fcf2b29ed |
| Issue introduced in 5.10.229 with commit a27a5c40ee4cbe00294e2c76160de5f2589061ba |
| Issue introduced in 5.15.171 with commit 9f605135a5c0fe614c2b15197b9ced1e217eca59 |
| Issue introduced in 6.11.7 with commit 705350fbd6ed4b5d89ee045fa57a0594a72b17d7 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2025-21629 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/core/dev.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/ac9cfef69565021c9e1022a493a9c40b03e2caf9 |
| https://git.kernel.org/stable/c/95ccf006bbc8b59044313b8c309dcf29c546abd4 |
| https://git.kernel.org/stable/c/d3b7a9c7597b779039a51d7b34116fbe424bf2b7 |
| https://git.kernel.org/stable/c/68e068cabd2c6c533ef934c2e5151609cf6ecc6d |
