CVE-2025-39770

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM

When performing Generic Segmentation Offload (GSO) on an IPv6 packet that

contains extension headers, the kernel incorrectly requests checksum offload

if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has

a strict contract: it supports checksum offload only for plain TCP or UDP

over IPv6 and explicitly does not support packets with extension headers.

The current GSO logic violates this contract by failing to disable the feature

for packets with extension headers, such as those used in GREoIPv6 tunnels.

This violation results in the device being asked to perform an operation

it cannot support, leading to a `skb_warn_bad_offload` warning and a collapse

of network throughput. While device TSO/USO is correctly bypassed in favor

of software GSO for these packets, the GSO stack must be explicitly told not

to request checksum offlo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References