CVE-2025-40337: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40337 is a vulnerability in the Linux kernel's net/stmmac (STMicroelectronics MAC) network driver related to incorrect handling of hardware Rx checksum offload (CoE) errors. The stmmac_rx function failed to check whether the hardware had reported a checksum error, allowing corrupt packets to be passed up the network stack as valid. It was published on December 9, 2025, and affects Linux kernel versions from the initial commit up to (but not including) the patched stable releases. It carries a CVSS v3.1 base score of 5.5 (Medium), with a local attack vector and high availability impact (MSRC, ENISA EUVD).

The root cause is improper input validation / incorrect logic in the stmmac_rx function (CWE-754: Improper Check for Unusual or Exceptional Conditions). When hardware checksum offload (CoE) was enabled and a packet matched a known IP ethertype, the driver unconditionally set skb->ip_summed to CHECKSUM_UNNECESSARY, bypassing the kernel's software checksum validation — even when the hardware had flagged a header or payload checksum failure via the csum_none status bit. The fix checks the csum_none flag and, when set, assigns CHECKSUM_NONE to skb->ip_summed, forcing the kernel network stack to perform its own validation. Exploitation requires local access (e.g., the ability to send crafted network packets to an interface using the stmmac driver) (MSRC, ENISA EUVD).

The primary impact is an availability risk: corrupt network packets with invalid checksums can be silently accepted and processed by the kernel's network stack rather than being discarded, potentially causing application-layer misbehavior, data corruption, or denial-of-service conditions in software relying on checksum integrity. There is no direct confidentiality or integrity impact on the host system itself, and lateral movement potential is limited. The vulnerability affects systems using the stmmac Ethernet driver, which is common in embedded and SoC-based Linux platforms (MSRC, ENISA EUVD).

The Linux kernel stable trees have been patched in the following versions: 6.6.117, 6.12.58, 6.17.8, and 6.18 (mainline). Microsoft has also released a patch for the Azure Linux 3 kernel (azl3_kernel_6.6.112.1-2 and later). Users should update to the appropriate patched kernel version for their distribution. No configuration-based workaround is documented; disabling hardware checksum offload on the affected interface (e.g., via ethtool -K <iface> rx-checksum off) may mitigate the issue as a temporary measure until patching is possible (MSRC, ENISA EUVD).