CVE-2025-22101

What it actually does

The vulnerability causes the libwx network driver to incorrectly set Tx checksum offload flags for protocols other than TCP/UDP/SCTP, resulting in Tx ring hangs.

Why it matters to the business

Network transmission failures can interrupt connectivity and service availability on affected systems, including database workloads, with remediation required on widely deployed enterprise Linux distributions.

How an attack unfolds

An attacker sends network packets using unsupported L4 protocols to trigger the erroneous checksum flag, causing hardware transmission ring hangs without authentication or special privileges.

How to fix it

Upgrade affected packages to the listed fixed versions including postgresql 0:16.6-1.module+el9.5.0+22557+8cb08ba5 and equivalent updates for all listed postgresql packages on Red Hat Enterprise Linux 9.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed releases and verify absence of Tx ring hang symptoms under mixed-protocol network traffic.

Typical attack path

1. Locate systems running the vulnerable network driver
2. Craft packets using non-TCP/UDP/SCTP protocols
3. Transmit packets to induce Tx ring hang and disrupt network operations

How to detect it

Review kernel and network driver logs for Tx ring hang messages and unexpected checksum-related errors on systems running the vulnerable driver.

What your security team should do

• Apply the specified package updates across all affected Red Hat Enterprise Linux 9 systems
• Prioritize patching based on network exposure and service criticality
• Monitor kernel logs for Tx ring hang events during the update window