CVE-2025-38572: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-38572 Overview

CVE-2025-38572 is a Linux kernel vulnerability in the IPv6 Generic Segmentation Offload (GSO) code path. The flaw lives in ipv6_gso_segment() within net/ipv6/ip6_offload.c. A crafted packet carrying very long IPv6 extension headers can overflow the 16-bit skb->transport_header field. Google's syzbot fuzzer discovered the condition, which triggers a WARNING at include/linux/skbuff.h:3032 inside skb_reset_transport_header(). The issue affects mainline Linux kernel versions and Debian Linux 11. Maintainers resolved it by introducing a new skb_reset_transport_header_careful() helper that validates the offset before assignment.

Critical Impact
A local attacker able to inject crafted IPv6 packets through the network stack can trigger memory corruption in the kernel, leading to denial of service or potential local privilege escalation.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Debian Linux 11 (Bullseye)
Any distribution shipping affected upstream kernel versions

Discovery Timeline

2025-08-19 - CVE-2025-38572 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-38572

Vulnerability Analysis

The vulnerability is an integer overflow in the IPv6 GSO segmentation path. When the kernel processes an outbound IPv6 packet through Generic Segmentation Offload, ipv6_gso_segment() walks the chain of IPv6 extension headers to locate the transport header offset. That offset is stored in skb->transport_header, a 16-bit field with a maximum representable value of 65,535 bytes.

A packet crafted with an unusually long chain of IPv6 extension headers produces an offset that exceeds the 16-bit range. The subsequent call to skb_reset_transport_header() writes a truncated value, corrupting the socket buffer's internal state. The kernel emits a WARNING at include/linux/skbuff.h:3032, and subsequent processing operates on an invalid transport header offset.

The call chain observed by syzbot traversed __dev_queue_xmit() → validate_xmit_skb_list() → __skb_gso_segment() → nsh_gso_segment() → ipv6_gso_segment(), confirming the flaw is reachable through standard transmit paths.

Root Cause

The root cause is missing bounds validation before assigning a computed header offset to a 16-bit field. Prior to the fix, ipv6_gso_segment() unconditionally called skb_reset_transport_header() regardless of whether the extension-header chain length fit within the field's range. The patch introduces skb_reset_transport_header_careful(), which rejects offsets that would overflow and allows callers to reject the malicious packet cleanly.

Attack Vector

Exploitation requires local privileges sufficient to craft and transmit raw IPv6 packets, for example via AF_PACKET sockets or namespace-scoped network interfaces. An attacker constructs an IPv6 datagram with a stack of extension headers (Hop-by-Hop, Destination Options, Routing) large enough to push the transport header offset beyond 65,535 bytes. Submitting the packet through the transmit path triggers the flaw during GSO processing. Because the vulnerability corrupts kernel socket-buffer state, successful triggering can result in kernel warnings, denial of service, or memory-safety violations depending on downstream consumers of the skb.

No public proof-of-concept exploit is currently available, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Linux kernel fix commit ef05007 for the reference implementation of the fix.

Detection Methods for CVE-2025-38572

Indicators of Compromise

Kernel log entries containing WARNING at include/linux/skbuff.h:3032 referencing skb_reset_transport_header or ipv6_gso_segment+
Repeated WARN_ON traces originating from the net/ipv6/ip6_offload.c:151 call site
Unexpected process names invoking raw socket operations followed by kernel warnings on the same CPU

Detection Strategies

Collect and parse dmesg output for the specific warning signature and correlate with the invoking PID and UID
Deploy auditd rules to record socket() syscalls creating AF_PACKET or raw IPv6 sockets by non-root users
Monitor eBPF tracepoints on ipv6_gso_segment for abnormally deep IPv6 extension header chains

Monitoring Recommendations

Forward kernel ring-buffer events to a centralized logging pipeline and alert on the ipv6_gso_segment warning signature
Track unprivileged use of network namespaces and raw sockets, which are prerequisites for reaching the vulnerable path
Baseline normal outbound IPv6 packet header composition per host and alert on packets exceeding realistic extension-header counts

How to Mitigate CVE-2025-38572

Immediate Actions Required

Inventory Linux hosts and identify kernels that predate the fix commits listed in the vendor advisories
Apply the vendor-supplied kernel update from your distribution and reboot affected systems
Restrict CAP_NET_RAW and access to unprivileged user namespaces on multi-tenant hosts until patching is complete

Patch Information

The upstream fix introduces skb_reset_transport_header_careful() and applies it in ipv6_gso_segment(). The fix has been backported across multiple stable branches. Reference commits include 09ff062, 3f638e0, 5489e7f, 573b825, 5dc60b2, d45cf1e7, de322cd, ee85176, and ef05007. Debian users should consult Debian LTS Announcement #7 and Debian LTS Announcement #8.

Workarounds

Disable unprivileged user namespaces where feasible by setting kernel.unprivileged_userns_clone=0 to reduce reachable attack surface
Drop or filter outbound IPv6 packets with excessive extension header chains at the host firewall or a bump-in-the-wire policy device
Remove CAP_NET_RAW from workloads that do not require it, and audit container runtime defaults

bash

# Example: restrict unprivileged raw socket creation and namespace use
sysctl -w kernel.unprivileged_userns_clone=0
sysctl -w net.ipv4.ping_group_range="1 0"

# Verify running kernel version after patching
uname -r

# Debian: apply security updates
apt update && apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')