CVE-2025-39874 (GCVE-0-2025-39874)
Vulnerability from cvelistv5
Published
2025-09-23 06:00
Modified
2025-09-29 06:01
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
macsec: sync features on RTM_NEWLINK
Syzkaller managed to lock the lower device via ETHTOOL_SFEATURES:
netdev_lock include/linux/netdevice.h:2761 [inline]
netdev_lock_ops include/net/netdev_lock.h:42 [inline]
netdev_sync_lower_features net/core/dev.c:10649 [inline]
__netdev_update_features+0xcb1/0x1be0 net/core/dev.c:10819
netdev_update_features+0x6d/0xe0 net/core/dev.c:10876
macsec_notify+0x2f5/0x660 drivers/net/macsec.c:4533
notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
call_netdevice_notifiers net/core/dev.c:2281 [inline]
netdev_features_change+0x85/0xc0 net/core/dev.c:1570
__dev_ethtool net/ethtool/ioctl.c:3469 [inline]
dev_ethtool+0x1536/0x19b0 net/ethtool/ioctl.c:3502
dev_ioctl+0x392/0x1150 net/core/dev_ioctl.c:759
It happens because lower features are out of sync with the upper:
__dev_ethtool (real_dev)
netdev_lock_ops(real_dev)
ETHTOOL_SFEATURES
__netdev_features_change
netdev_sync_upper_features
disable LRO on the lower
if (old_features != dev->features)
netdev_features_change
fires NETDEV_FEAT_CHANGE
macsec_notify
NETDEV_FEAT_CHANGE
netdev_update_features (for each macsec dev)
netdev_sync_lower_features
if (upper_features != lower_features)
netdev_lock_ops(lower) # lower == real_dev
stuck
...
netdev_unlock_ops(real_dev)
Per commit af5f54b0ef9e ("net: Lock lower level devices when updating
features"), we elide the lock/unlock when the upper and lower features
are synced. Makes sure the lower (real_dev) has proper features after
the macsec link has been created. This makes sure we never hit the
situation where we need to sync upper flags to the lower.
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/macsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d7624629ccf47135c65fef0701fa0d9a115b87f3",
"status": "affected",
"version": "7e4d784f5810bba76c4593791028e13cce4af547",
"versionType": "git"
},
{
"lessThan": "0f82c3ba66c6b2e3cde0f255156a753b108ee9dc",
"status": "affected",
"version": "7e4d784f5810bba76c4593791028e13cce4af547",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/macsec.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.8",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacsec: sync features on RTM_NEWLINK\n\nSyzkaller managed to lock the lower device via ETHTOOL_SFEATURES:\n\n netdev_lock include/linux/netdevice.h:2761 [inline]\n netdev_lock_ops include/net/netdev_lock.h:42 [inline]\n netdev_sync_lower_features net/core/dev.c:10649 [inline]\n __netdev_update_features+0xcb1/0x1be0 net/core/dev.c:10819\n netdev_update_features+0x6d/0xe0 net/core/dev.c:10876\n macsec_notify+0x2f5/0x660 drivers/net/macsec.c:4533\n notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85\n call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]\n call_netdevice_notifiers net/core/dev.c:2281 [inline]\n netdev_features_change+0x85/0xc0 net/core/dev.c:1570\n __dev_ethtool net/ethtool/ioctl.c:3469 [inline]\n dev_ethtool+0x1536/0x19b0 net/ethtool/ioctl.c:3502\n dev_ioctl+0x392/0x1150 net/core/dev_ioctl.c:759\n\nIt happens because lower features are out of sync with the upper:\n\n __dev_ethtool (real_dev)\n netdev_lock_ops(real_dev)\n ETHTOOL_SFEATURES\n __netdev_features_change\n netdev_sync_upper_features\n disable LRO on the lower\n if (old_features != dev-\u003efeatures)\n netdev_features_change\n fires NETDEV_FEAT_CHANGE\n\tmacsec_notify\n\t NETDEV_FEAT_CHANGE\n\t netdev_update_features (for each macsec dev)\n\t netdev_sync_lower_features\n\t if (upper_features != lower_features)\n\t netdev_lock_ops(lower) # lower == real_dev\n\t\t stuck\n\t\t ...\n\n netdev_unlock_ops(real_dev)\n\nPer commit af5f54b0ef9e (\"net: Lock lower level devices when updating\nfeatures\"), we elide the lock/unlock when the upper and lower features\nare synced. Makes sure the lower (real_dev) has proper features after\nthe macsec link has been created. This makes sure we never hit the\nsituation where we need to sync upper flags to the lower."
}
],
"providerMetadata": {
"dateUpdated": "2025-09-29T06:01:31.845Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d7624629ccf47135c65fef0701fa0d9a115b87f3"
},
{
"url": "https://git.kernel.org/stable/c/0f82c3ba66c6b2e3cde0f255156a753b108ee9dc"
}
],
"title": "macsec: sync features on RTM_NEWLINK",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39874",
"datePublished": "2025-09-23T06:00:46.690Z",
"dateReserved": "2025-04-16T07:20:57.144Z",
"dateUpdated": "2025-09-29T06:01:31.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-39874\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-23T06:15:46.813\",\"lastModified\":\"2025-09-24T18:11:24.520\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmacsec: sync features on RTM_NEWLINK\\n\\nSyzkaller managed to lock the lower device via ETHTOOL_SFEATURES:\\n\\n netdev_lock include/linux/netdevice.h:2761 [inline]\\n netdev_lock_ops include/net/netdev_lock.h:42 [inline]\\n netdev_sync_lower_features net/core/dev.c:10649 [inline]\\n __netdev_update_features+0xcb1/0x1be0 net/core/dev.c:10819\\n netdev_update_features+0x6d/0xe0 net/core/dev.c:10876\\n macsec_notify+0x2f5/0x660 drivers/net/macsec.c:4533\\n notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85\\n call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]\\n call_netdevice_notifiers net/core/dev.c:2281 [inline]\\n netdev_features_change+0x85/0xc0 net/core/dev.c:1570\\n __dev_ethtool net/ethtool/ioctl.c:3469 [inline]\\n dev_ethtool+0x1536/0x19b0 net/ethtool/ioctl.c:3502\\n dev_ioctl+0x392/0x1150 net/core/dev_ioctl.c:759\\n\\nIt happens because lower features are out of sync with the upper:\\n\\n __dev_ethtool (real_dev)\\n netdev_lock_ops(real_dev)\\n ETHTOOL_SFEATURES\\n __netdev_features_change\\n netdev_sync_upper_features\\n disable LRO on the lower\\n if (old_features != dev-\u003efeatures)\\n netdev_features_change\\n fires NETDEV_FEAT_CHANGE\\n\\tmacsec_notify\\n\\t NETDEV_FEAT_CHANGE\\n\\t netdev_update_features (for each macsec dev)\\n\\t netdev_sync_lower_features\\n\\t if (upper_features != lower_features)\\n\\t netdev_lock_ops(lower) # lower == real_dev\\n\\t\\t stuck\\n\\t\\t ...\\n\\n netdev_unlock_ops(real_dev)\\n\\nPer commit af5f54b0ef9e (\\\"net: Lock lower level devices when updating\\nfeatures\\\"), we elide the lock/unlock when the upper and lower features\\nare synced. Makes sure the lower (real_dev) has proper features after\\nthe macsec link has been created. This makes sure we never hit the\\nsituation where we need to sync upper flags to the lower.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0f82c3ba66c6b2e3cde0f255156a753b108ee9dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d7624629ccf47135c65fef0701fa0d9a115b87f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…