CVE-2025-21789 (GCVE-0-2025-21789)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:18 – Updated: 2026-08-05 11:54
VLAI
Title
LoongArch: csum: Fix OoB access in IP checksum code for negative lengths
Summary
In the Linux kernel, the following vulnerability has been resolved: LoongArch: csum: Fix OoB access in IP checksum code for negative lengths Commit 69e3a6aa6be2 ("LoongArch: Add checksum optimization for 64-bit system") would cause an undefined shift and an out-of-bounds read. Commit 8bd795fedb84 ("arm64: csum: Fix OoB access in IP checksum code for negative lengths") fixes the same issue on ARM64.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:29 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 69e3a6aa6be21de6aaf38130fad97ecde34a193c , < 964a8895704a22efc06a2a3276b624a5ae985a06 (git)
Affected: 69e3a6aa6be21de6aaf38130fad97ecde34a193c , < 9f15a8df542c0f08732a67d1a14ee7c22948fb97 (git)
Affected: 69e3a6aa6be21de6aaf38130fad97ecde34a193c , < d6508ffff32b44b6d0de06704034e4eef1c307a7 (git)
Affected: 69e3a6aa6be21de6aaf38130fad97ecde34a193c , < 6287f1a8c16138c2ec750953e35039634018c84a (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.6.79 , ≤ 6.6.* (semver)
Unaffected: 6.12.16 , ≤ 6.12.* (semver)
Unaffected: 6.13.4 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21789",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:29:57.287707Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-125",
                "description": "CWE-125 Out-of-bounds Read",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:36:39.729Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/lib/csum.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "964a8895704a22efc06a2a3276b624a5ae985a06",
              "status": "affected",
              "version": "69e3a6aa6be21de6aaf38130fad97ecde34a193c",
              "versionType": "git"
            },
            {
              "lessThan": "9f15a8df542c0f08732a67d1a14ee7c22948fb97",
              "status": "affected",
              "version": "69e3a6aa6be21de6aaf38130fad97ecde34a193c",
              "versionType": "git"
            },
            {
              "lessThan": "d6508ffff32b44b6d0de06704034e4eef1c307a7",
              "status": "affected",
              "version": "69e3a6aa6be21de6aaf38130fad97ecde34a193c",
              "versionType": "git"
            },
            {
              "lessThan": "6287f1a8c16138c2ec750953e35039634018c84a",
              "status": "affected",
              "version": "69e3a6aa6be21de6aaf38130fad97ecde34a193c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/loongarch/lib/csum.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.79",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.79",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.16",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.4",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: csum: Fix OoB access in IP checksum code for negative lengths\n\nCommit 69e3a6aa6be2 (\"LoongArch: Add checksum optimization for 64-bit\nsystem\") would cause an undefined shift and an out-of-bounds read.\n\nCommit 8bd795fedb84 (\"arm64: csum: Fix OoB access in IP checksum code\nfor negative lengths\") fixes the same issue on ARM64."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The negative length originates from skb metadata (csum_start vs. transport header offset) that the attacker sets locally via an AF_PACKET/tun socket with virtio_net_hdr, not from remote packet header fields \u2014 every RX path that derives lengths from peer-supplied headers validates them first (e.g. `tcf_csum_skb_nextlayer()`\u0027s `ipl \u003c hl` check). Exploitation therefore requires local socket API access.\nAC:L - The attacker deterministically chooses csum_start, csum_offset and gso_size in the virtio_net_hdr and immediately drives the packet through the GSO segmentation path; there is no race, no memory-layout dependency, and no state outside the attacker\u0027s control.\nPR:L - An unprivileged local user can obtain CAP_NET_RAW in a new user+network namespace (`unshare -Urn`) and open the AF_PACKET socket needed to inject the crafted virtio_net_hdr; no real root and no init-namespace capability is required.\nUI:N - The entire sequence is a single sendmsg() by the attacker\u0027s own process; no victim action, mount, or file open is involved.\nS:U - The out-of-bounds read stays within the kernel\u0027s own address space and security authority \u2014 there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a slab-out-of-bounds read (KASAN reports it as an unbounded ~4 GB read) whose out-of-bounds bytes are folded into the checksum that is then written into the outgoing packet header and transmitted, giving the attacker an observable channel onto adjacent kernel heap contents.\nI:L - The undefined shift makes the tail-masking meaningless, so a corrupted checksum is computed from out-of-bounds data and stored into the transmitted packet\u0027s checksum field; this modifies network data but yields no kernel memory write primitive.\nA:H - On KASAN/UBSAN-instrumented kernels the negative length produces a slab-out-of-bounds report and an undefined-shift splat that panics under the widely deployed panic_on_warn setting, and the huge shadow-memory scan from `kasan_check_read()` with a ~4 GB size makes an oops the expected outcome."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:54:27.092Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/964a8895704a22efc06a2a3276b624a5ae985a06"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f15a8df542c0f08732a67d1a14ee7c22948fb97"
        },
        {
          "url": "https://git.kernel.org/stable/c/d6508ffff32b44b6d0de06704034e4eef1c307a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/6287f1a8c16138c2ec750953e35039634018c84a"
        }
      ],
      "title": "LoongArch: csum: Fix OoB access in IP checksum code for negative lengths",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21789",
    "datePublished": "2025-02-27T02:18:27.817Z",
    "dateReserved": "2024-12-29T08:45:45.766Z",
    "dateUpdated": "2026-08-05T11:54:27.092Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21789",
      "date": "2026-10-02",
      "epss": "0.0023",
      "percentile": "0.12544"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:35:00.000Z",
      "cve": "CVE-2025-21789",
      "id": "msrc_CVE-2025-21789",
      "initial_release_date": "2025-02-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "LoongArch: csum: Fix OoB access in IP checksum code for negative lengths",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21789.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "arch/loongarch/lib/csum.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "964a8895704a22efc06a2a3276b624a5ae985a06",
                    "status": "affected",
                    "version": "69e3a6aa6be21de6aaf38130fad97ecde34a193c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9f15a8df542c0f08732a67d1a14ee7c22948fb97",
                    "status": "affected",
                    "version": "69e3a6aa6be21de6aaf38130fad97ecde34a193c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d6508ffff32b44b6d0de06704034e4eef1c307a7",
                    "status": "affected",
                    "version": "69e3a6aa6be21de6aaf38130fad97ecde34a193c",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6287f1a8c16138c2ec750953e35039634018c84a",
                    "status": "affected",
                    "version": "69e3a6aa6be21de6aaf38130fad97ecde34a193c",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "arch/loongarch/lib/csum.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.4"
                  },
                  {
                    "lessThan": "6.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.79",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "AF2C1DB1-DF96-4ED9-BEE9-807807D25645",
                    "versionEndExcluding": "6.6.79",
                    "versionStartIncluding": "6.4",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "13C8DB18-FC60-425F-84E5-3EDDEC61B2FC",
                    "versionEndExcluding": "6.12.16",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2A2093ED-74A9-43F9-AC72-50030F374EA4",
                    "versionEndExcluding": "6.13.4",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: csum: Fix OoB access in IP checksum code for negative lengths\n\nCommit 69e3a6aa6be2 (\"LoongArch: Add checksum optimization for 64-bit\nsystem\") would cause an undefined shift and an out-of-bounds read.\n\nCommit 8bd795fedb84 (\"arm64: csum: Fix OoB access in IP checksum code\nfor negative lengths\") fixes the same issue on ARM64."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: LoongArch: csum: Fix OoB access in IP checksum code for negative lengths (LoongArch: csum: corregir el acceso OoB en el c\u00f3digo de suma de comprobaci\u00f3n de IP para longitudes negativas). el commit 69e3a6aa6be2 (\"LoongArch: a\u00f1adir optimizaci\u00f3n de suma de comprobaci\u00f3n para sistemas de 64 bits\") provocar\u00eda un desplazamiento indefinido y una lectura fuera de los l\u00edmites. el commit 8bd795fedb84 (\"arm64: csum: corregir el acceso OoB en el c\u00f3digo de suma de comprobaci\u00f3n de IP para longitudes negativas\") corrige el mismo problema en ARM64."
          }
        ],
        "id": "CVE-2025-21789",
        "lastModified": "2026-07-30T06:21:30.987",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-21789",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:29:57.287707Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-02-27T03:15:19.763",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6287f1a8c16138c2ec750953e35039634018c84a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/964a8895704a22efc06a2a3276b624a5ae985a06"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/9f15a8df542c0f08732a67d1a14ee7c22948fb97"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d6508ffff32b44b6d0de06704034e4eef1c307a7"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T07:36:18+00:00",
      "cve": "CVE-2025-21789",
      "id": "CVE-2025-21789",
      "initial_release_date": "2025-02-27T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: LoongArch: csum: Fix OoB access in IP checksum code for negative lengths",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21789.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:27:41Z",
      "cve": "CVE-2025-21789",
      "id": "CVE-2025-21789",
      "initial_release_date": "2025-02-28T02:20:42Z",
      "product_status:known_not_affected": "578",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21789",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21789.json",
      "version": "20"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 7.1,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "HIGH",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-21789",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T19:29:57.287707Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-125",
                    "description": "CWE-125 Out-of-bounds Read",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T16:56:20.273Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "arch/loongarch/lib/csum.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "964a8895704a22efc06a2a3276b624a5ae985a06",
                  "status": "affected",
                  "version": "69e3a6aa6be21de6aaf38130fad97ecde34a193c",
                  "versionType": "git"
                },
                {
                  "lessThan": "9f15a8df542c0f08732a67d1a14ee7c22948fb97",
                  "status": "affected",
                  "version": "69e3a6aa6be21de6aaf38130fad97ecde34a193c",
                  "versionType": "git"
                },
                {
                  "lessThan": "d6508ffff32b44b6d0de06704034e4eef1c307a7",
                  "status": "affected",
                  "version": "69e3a6aa6be21de6aaf38130fad97ecde34a193c",
                  "versionType": "git"
                },
                {
                  "lessThan": "6287f1a8c16138c2ec750953e35039634018c84a",
                  "status": "affected",
                  "version": "69e3a6aa6be21de6aaf38130fad97ecde34a193c",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "arch/loongarch/lib/csum.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "6.4"
                },
                {
                  "lessThan": "6.4",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.79",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.16",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.13.*",
                  "status": "unaffected",
                  "version": "6.13.4",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.14",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.79",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.16",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.13.4",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.14",
                      "versionStartIncluding": "6.4",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: csum: Fix OoB access in IP checksum code for negative lengths\n\nCommit 69e3a6aa6be2 (\"LoongArch: Add checksum optimization for 64-bit\nsystem\") would cause an undefined shift and an out-of-bounds read.\n\nCommit 8bd795fedb84 (\"arm64: csum: Fix OoB access in IP checksum code\nfor negative lengths\") fixes the same issue on ARM64."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The negative length originates from skb metadata (csum_start vs. transport header offset) that the attacker sets locally via an AF_PACKET/tun socket with virtio_net_hdr, not from remote packet header fields \u2014 every RX path that derives lengths from peer-supplied headers validates them first (e.g. `tcf_csum_skb_nextlayer()`\u0027s `ipl \u003c hl` check). Exploitation therefore requires local socket API access.\nAC:L - The attacker deterministically chooses csum_start, csum_offset and gso_size in the virtio_net_hdr and immediately drives the packet through the GSO segmentation path; there is no race, no memory-layout dependency, and no state outside the attacker\u0027s control.\nPR:L - An unprivileged local user can obtain CAP_NET_RAW in a new user+network namespace (`unshare -Urn`) and open the AF_PACKET socket needed to inject the crafted virtio_net_hdr; no real root and no init-namespace capability is required.\nUI:N - The entire sequence is a single sendmsg() by the attacker\u0027s own process; no victim action, mount, or file open is involved.\nS:U - The out-of-bounds read stays within the kernel\u0027s own address space and security authority \u2014 there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - This is a slab-out-of-bounds read (KASAN reports it as an unbounded ~4 GB read) whose out-of-bounds bytes are folded into the checksum that is then written into the outgoing packet header and transmitted, giving the attacker an observable channel onto adjacent kernel heap contents.\nI:L - The undefined shift makes the tail-masking meaningless, so a corrupted checksum is computed from out-of-bounds data and stored into the transmitted packet\u0027s checksum field; this modifies network data but yields no kernel memory write primitive.\nA:H - On KASAN/UBSAN-instrumented kernels the negative length produces a slab-out-of-bounds report and an undefined-shift splat that panics under the widely deployed panic_on_warn setting, and the huge shadow-memory scan from `kasan_check_read()` with a ~4 GB size makes an oops the expected outcome."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T11:54:27.092Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/964a8895704a22efc06a2a3276b624a5ae985a06"
            },
            {
              "url": "https://git.kernel.org/stable/c/9f15a8df542c0f08732a67d1a14ee7c22948fb97"
            },
            {
              "url": "https://git.kernel.org/stable/c/d6508ffff32b44b6d0de06704034e4eef1c307a7"
            },
            {
              "url": "https://git.kernel.org/stable/c/6287f1a8c16138c2ec750953e35039634018c84a"
            }
          ],
          "title": "LoongArch: csum: Fix OoB access in IP checksum code for negative lengths",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-21789",
        "datePublished": "2025-02-27T02:18:27.817Z",
        "dateReserved": "2024-12-29T08:45:45.766Z",
        "dateUpdated": "2026-08-05T11:54:27.092Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.