CVE-2025-40337

Vulnerability

Overview

The Linux kernel's stmmac network driver, used for STMicroelectronics Ethernet controllers, contained a flaw in its receive path. When hardware checksum offload (CoE) was enabled and a packet had a known IP ethertype, the stmmac_rx function unconditionally set skb->ip_summed to CHECKSUM_UNNECESSARY. This logic failed to verify whether the hardware had actually reported a checksum error, meaning corrupt packets could be passed up the network stack as if they were valid [1].

Exploitation

Prerequisites

An attacker would need to send packets with intentionally corrupted checksums to a system using the stmmac driver with hardware checksum offload enabled. No authentication is required; the attack is purely network-based. The vulnerability affects the kernel's handling of received frames, so the attacker must be able to deliver malicious packets to the target interface.

Impact

If exploited, the kernel would treat corrupt packets as having valid checksums, potentially leading to data corruption, incorrect protocol processing, or further exploitation of higher-layer vulnerabilities. The fix ensures that when the hardware sets the csum_none status flag (indicating a checksum error), skb->ip_summed is set to CHECKSUM_NONE, forcing the kernel to perform its own validation and properly handle the corrupt packet [1].

Mitigation

The vulnerability is patched in the Linux kernel stable tree via commit ee0aace5f844. Users should update their kernel to include this fix. No workaround is mentioned; disabling hardware checksum offload may reduce risk but is not a complete mitigation.