IPv6 Checksum Offload Vulnerability in Linux Kernel - CVE-2025-21629
Summary
CVE-2025-21629: In the Linux kernel, the following vulnerability has been resolved: net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets The blamed commit disabled hardware offoad of IPv6 packets with extension headers on devices... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It supports various networking features, including IPv6, which is crucial for modern internet connectivity. The kernel's ability to offload certain tasks to hardware can enhance performance, but vulnerabilities in this area can lead to significant security risks.
Vulnerability Detail
CVE-2025-21629 is a vulnerability in the Linux kernel that affects the handling of IPv6 packets with extension headers. The issue arose from a commit that disabled hardware offload for IPv6 packets with extension headers on devices that support NETIF_F_IPV6_CSUM. This change led to warnings for BIG TCP packets, which utilize an IPv6 extension header to communicate packet length. The vulnerability can result in improper handling of these packets, potentially leading to data integrity issues and performance degradation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can disable the use of BIG TCP or avoid using devices that advertise NETIF_F_IPV6_CSUM until the patch is applied. This can be done by modifying network configurations or using alternative devices that do not exhibit this feature.
Conclusion
CVE-2025-21629 is a significant vulnerability in the Linux kernel that affects the handling of IPv6 packets with extension headers. Users are advised to update their systems to the latest patched version to mitigate potential risks. Temporary workarounds are available for those unable to update immediately.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21629 is a vulnerability in the Linux kernel that affects the offloading of IPv6 packets with extension headers, potentially leading to data integrity issues.
This vulnerability can cause improper handling of BIG TCP packets, which may degrade network performance and compromise data integrity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider disabling BIG TCP or using alternative devices that do not support NETIF_F_IPV6_CSUM as a temporary workaround.
More information can be found in the official CVE database or by reviewing the Linux kernel changelogs related to this issue.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
