CVE-2025-40337

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

The bug is triggered by a received Ethernet frame whose TCP/UDP checksum the DWMAC engine flags as bad; L4 checksums are end-to-end and are neither validated nor repaired by intermediate routers (NAT's incremental update preserves the incorrect value), so an attacker anywhere on the internet can deliver the triggering packet to a stmmac interface. No local access or adjacency is needed.

AC:LAttack complexity, low

The attacker directly controls the trigger — they simply write an incorrect checksum field into the packet they send, and the driver deterministically marks it CHECKSUM_UNNECESSARY. There is no race, no memory-layout dependency, and RX COE is enabled by default on all stmmac cores that advertise it.

PR:NPrivileges required, none

The vulnerable code is in the NAPI receive path, executed on every inbound frame before any socket, authentication, or authorization check. An unauthenticated remote sender needs no credentials or account on the target.

UI:NUser interaction, none

Packet reception and NAPI processing happen automatically; no action by any local user or administrator is required for the corrupt packet to be accepted and delivered up the stack.

S:UScope, unchanged

The mis-marked skb is consumed by the same host's network stack and its applications; no VM, IOMMU, or sandbox boundary is crossed, so the vulnerable and impacted components share one security authority.

C:NConfidentiality impact, none

The flaw only mislabels a checksum result — there is no out-of-bounds read, no uninitialized memory exposure, and no kernel data is disclosed to the attacker. Packet lengths still come from independently validated IP header fields.

I:HIntegrity impact, high

The kernel affirmatively asserts "checksum verified" for packets the hardware reported as corrupt, so the transport-layer integrity protection for all received IP traffic on the interface is completely lost and corrupt or attacker-mangled payloads reach applications as authentic. It also lets an attacker inject TCP segments that checksum-validating IDS/IPS and passive monitors discard but the host accepts, a security-control bypass and stream-desynchronization attack.

A:LAvailability impact, low

Accepted corrupt segments — flipped control flags, mangled payloads — cause spurious connection teardowns and application-level protocol failures, degrading service reliability. There is no kernel crash, hang, or deadlock in this path, so the availability loss is partial rather than total.