CVE-2025-38572
highpriority · track · 31EPSS 0.002 · 9 %ileDEEURUUSEPSS · scored 2026-10-27
In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: <TASK> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950 validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- Fixedkgraft-patch-4_12_14-122_237-default-0:16-2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkgraft-patch-4_12_14-122_237-default-0:16-2.1.s390x as component of SUSE Linux Enterprise Live Patching 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkgraft-patch-4_12_14-122_237-default-0:16-2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkgraft-patch-4_12_14-122_272-default-0:4-2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkgraft-patch-4_12_14-122_272-default-0:4-2.1.s390x as component of SUSE Linux Enterprise Live Patching 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkgraft-patch-4_12_14-122_272-default-0:4-2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_150-default-0:13-150400.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_150-default-0:13-150400.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_150-default-0:13-150400.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_147-default-0:18-150400.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_147-default-0:18-150400.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_147-default-0:18-150400.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_164-default-0:12-150400.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_164-default-0:12-150400.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_164-default-0:12-150400.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_88-default-0:17-150500.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_88-default-0:17-150500.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_88-default-0:17-150500.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_144-default-0:19-150400.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_144-default-0:19-150400.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_144-default-0:19-150400.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_176-default-0:6-150400.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_176-default-0:6-150400.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_176-default-0:6-150400.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_97-default-0:13-150500.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_97-default-0:13-150500.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_97-default-0:13-150500.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_110-default-0:11-150500.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_110-default-0:11-150500.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_110-default-0:11-150500.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_116-default-0:8-150500.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_116-default-0:8-150500.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_116-default-0:8-150500.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_121-default-0:5-150500.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_121-default-0:5-150500.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_121-default-0:5-150500.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_173-default-0:7-150400.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_173-default-0:7-150400.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150400_24_173-default-0:7-150400.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP4suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_94-default-0:13-150500.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_94-default-0:13-150500.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_94-default-0:13-150500.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_91-default-0:17-150500.2.1.ppc64le as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_91-default-0:17-150500.2.1.s390x as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-5_14_21-150500_55_91-default-0:17-150500.2.1.x86_64 as component of SUSE Linux Enterprise Live Patching 15 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-6_12_0-160000_5-default-0:5-160000.4.3.ppc64le as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-6_12_0-160000_5-default-0:5-160000.4.3.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-6_12_0-160000_5-default-0:5-160000.4.3.s390x as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-6_12_0-160000_5-default-0:5-160000.4.3.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-6_12_0-160000_5-default-0:5-160000.4.3.x86_64 as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-6_12_0-160000_5-default-0:5-160000.4.3.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-6_12_0-160000_5-default-0:5-160000.4.3.ppc64le as component of SUSE Linux Micro 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-6_12_0-160000_5-default-0:5-160000.4.3.s390x as component of SUSE Linux Micro 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
- Fixedkernel-livepatch-6_12_0-160000_5-default-0:5-160000.4.3.x86_64 as component of SUSE Linux Micro 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (70)
Products and version ranges known to be affected.
advisories (19)
Vendor and ecosystem advisories describing this.
- SUSE-SU-2026:0154-1Security update for the Linux Kernel (Live Patch 63 for SUSE Linux Enterprise 12 SP5)2026-01-19csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 63 for SUSE Linux Enterprise 12 SP5)
- SUSE-SU-2026:0155-1Security update for the Linux Kernel (Live Patch 72 for SUSE Linux Enterprise 12 SP5)2026-01-19csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 72 for SUSE Linux Enterprise 12 SP5)
- SUSE-SU-2026:0163-1Security update for the Linux Kernel (Live Patch 36 for SUSE Linux Enterprise 15 SP4)2026-01-19csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 36 for SUSE Linux Enterprise 15 SP4)
- SUSE-SU-2026:0166-1Security update for the Linux Kernel (Live Patch 35 for SUSE Linux Enterprise 15 SP4)2026-01-19csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 35 for SUSE Linux Enterprise 15 SP4)
- SUSE-SU-2026:0168-1Security update for the Linux Kernel (Live Patch 40 for SUSE Linux Enterprise 15 SP4)2026-01-19csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 40 for SUSE Linux Enterprise 15 SP4)
- SUSE-SU-2026:0173-1Security update for the Linux Kernel (Live Patch 21 for SUSE Linux Enterprise 15 SP5)2026-01-19csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 21 for SUSE Linux Enterprise 15 SP5)
- SUSE-SU-2026:0174-1Security update for the Linux Kernel (Live Patch 34 for SUSE Linux Enterprise 15 SP4)2026-01-19csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 34 for SUSE Linux Enterprise 15 SP4)
- SUSE-SU-2026:0176-1Security update for the Linux Kernel (Live Patch 44 for SUSE Linux Enterprise 15 SP4)2026-01-19csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 44 for SUSE Linux Enterprise 15 SP4)
- SUSE-SU-2026:0180-1Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise 15 SP5)2026-01-20csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 24 for SUSE Linux Enterprise 15 SP5)
- SUSE-SU-2026:0184-1Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise 15 SP5)2026-01-20csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 27 for SUSE Linux Enterprise 15 SP5)
- SUSE-SU-2026:0186-1Security update for the Linux Kernel (Live Patch 29 for SUSE Linux Enterprise 15 SP5)2026-01-20csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 29 for SUSE Linux Enterprise 15 SP5)
- SUSE-SU-2026:0187-1Security update for the Linux Kernel (Live Patch 30 for SUSE Linux Enterprise 15 SP5)2026-01-20csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 30 for SUSE Linux Enterprise 15 SP5)
- SUSE-SU-2026:0191-1Security update for the Linux Kernel (Live Patch 43 for SUSE Linux Enterprise 15 SP4)2026-01-20csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 43 for SUSE Linux Enterprise 15 SP4)
- SUSE-SU-2026:0206-1Security update for the Linux Kernel (Live Patch 23 for SUSE Linux Enterprise 15 SP5)2026-01-21csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 23 for SUSE Linux Enterprise 15 SP5)
- SUSE-SU-2026:0246-1Security update for the Linux Kernel (Live Patch 22 for SUSE Linux Enterprise 15 SP5)2026-01-22csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 22 for SUSE Linux Enterprise 15 SP5)
- SUSE-SU-2026:20149-1Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)2026-01-26csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)
- SUSE-SU-2026:20169-1Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)2026-01-26csaf · suse_csafDE
Security update for the Linux Kernel (Live Patch 0 for SUSE Linux Enterprise 16)
- WID-SEC-W-2025-1869Linux Kernel: Mehrere SchwachstellenDeutsch2025-08-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder andere nicht spezifizierte Angriffe durchzuführen.
- WID-SEC-W-2026-0349Dell Avamar und NetWorker: Mehrere SchwachstellenDeutsch2026-02-09csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Avamar und Dell NetWorker ausnutzen, um Angriffe zu starten, die die Integrität, Vertraulichkeit und Verfügbarkeit von Systemen beeinträchtigen.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (32)
External citations — patches, advisories, analysis.
- https://git.kernel.org/stable/c/09ff062b89d8e48165247d677d1ca23d6d607e9bcnnvd
- https://git.kernel.org/stable/c/3f638e0b28bde7c3354a0df938ab3a96739455d1cnnvd
- https://git.kernel.org/stable/c/5489e7fc6f8be3062f8cb7e49406de4bfd94db67cnnvd
- https://git.kernel.org/stable/c/573b8250fc2554761db3bc2bbdbab23789d52d4ecnnvd
- https://git.kernel.org/stable/c/5dc60b2a00ed7629214ac0c48e43f40af2078703cnnvd
- https://git.kernel.org/stable/c/d45cf1e7d7180256e17c9ce88e32e8061a7887fecnnvd
- https://git.kernel.org/stable/c/de322cdf600fc9433845a9e944d1ca6b31cfb67ecnnvd
- https://git.kernel.org/stable/c/ee851768e4b8371ce151fd446d24bf3ae2d18789cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan