CVE-2025-39874— macsec: sync features on RTM_NEWLINK
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-39874
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
macsec: sync features on RTM_NEWLINK
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: macsec: sync features on RTM_NEWLINK Syzkaller managed to lock the lower device via ETHTOOL_SFEATURES: netdev_lock include/linux/netdevice.h:2761 [inline] netdev_lock_ops include/net/netdev_lock.h:42 [inline] netdev_sync_lower_features net/core/dev.c:10649 [inline] __netdev_update_features+0xcb1/0x1be0 net/core/dev.c:10819 netdev_update_features+0x6d/0xe0 net/core/dev.c:10876 macsec_notify+0x2f5/0x660 drivers/net/macsec.c:4533 notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2267 [inline] call_netdevice_notifiers net/core/dev.c:2281 [inline] netdev_features_change+0x85/0xc0 net/core/dev.c:1570 __dev_ethtool net/ethtool/ioctl.c:3469 [inline] dev_ethtool+0x1536/0x19b0 net/ethtool/ioctl.c:3502 dev_ioctl+0x392/0x1150 net/core/dev_ioctl.c:759 It happens because lower features are out of sync with the upper: __dev_ethtool (real_dev) netdev_lock_ops(real_dev) ETHTOOL_SFEATURES __netdev_features_change netdev_sync_upper_features disable LRO on the lower if (old_features != dev->features) netdev_features_change fires NETDEV_FEAT_CHANGE macsec_notify NETDEV_FEAT_CHANGE netdev_update_features (for each macsec dev) netdev_sync_lower_features if (upper_features != lower_features) netdev_lock_ops(lower) # lower == real_dev stuck ... netdev_unlock_ops(real_dev) Per commit af5f54b0ef9e ("net: Lock lower level devices when updating features"), we elide the lock/unlock when the upper and lower features are synced. Makes sure the lower (real_dev) has proper features after the macsec link has been created. This makes sure we never hit the situation where we need to sync upper flags to the lower.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于macsec功能同步问题，可能导致设备锁定。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-39874
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-39874
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-09-23 · 21 CVEs total
| CVE-2025-39878 | ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error | |
| CVE-2025-39887 | tracing/osnoise: Fix null-ptr-deref in bitmap_parselist() | |
| CVE-2025-39888 | fuse: Block access to folio overlimit | |
| CVE-2025-39885 | ocfs2: fix recursive semaphore deadlock in fiemap call | |
| CVE-2025-39886 | bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() | |
| CVE-2025-39883 | mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory | |
| CVE-2025-39884 | btrfs: fix subvolume deletion lockup caused by inodes xarray race | |
| CVE-2025-39882 | drm/mediatek: fix potential OF node use-after-free | |
| CVE-2025-39880 | libceph: fix invalid accesses to ceph_connection_v1_info | |
| CVE-2025-39881 | kernfs: Fix UAF in polling when open file is released | |
| CVE-2025-39868 | erofs: fix runtime warning on truncate_folio_batch_exceptionals() | |
| CVE-2025-39879 | ceph: always call ceph_shift_unused_folios_left() | |
| CVE-2025-39877 | mm/damon/sysfs: fix use-after-free in state_show() | |
| CVE-2025-39876 | net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() | |
| CVE-2025-39875 | igb: Fix NULL pointer dereference in ethtool loopback test | |
| CVE-2025-39873 | can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB | |
| CVE-2025-39872 | hsr: hold rcu and dev lock for hsr_get_port_ndev | |
| CVE-2025-39871 | dmaengine: idxd: Remove improper idxd_free | |
| CVE-2025-39869 | dmaengine: ti: edma: Fix memory allocation size for queue_priority_map | |
| CVE-2025-39870 | dmaengine: idxd: Fix double free in idxd_setup_wqs() |
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2025-39874
No comments yet