CVE-2025-38572

What it actually does

Long IPv6 extension headers in crafted packets cause an overflow of the 16-bit skb->transport_header field during GSO segmentation in ipv6_gso_segment(), leading to invalid transport header offsets and potential memory corruption or crashes.

Why it matters to the business

Systems running affected Linux kernels, particularly in containerized or cloud environments with high network throughput, face denial-of-service risk or potential privilege escalation; the 434-day exposure window and mentions of container-optimized OS exploits increase urgency for organizations with downstream kernel dependents.

How an attack unfolds

An attacker sends a malicious IPv6 packet with oversized extension headers to a vulnerable system; during transmit path processing the kernel invokes ipv6_gso_segment() which overflows skb->transport_header, enabling memory corruption that VMSCAPE-style campaigns or container privilege-escalation chains can leverage for code execution.

How to fix it

Update Linux kernel to commit 5dc60b2a00ed7629214ac0c48e43f40af2078703 or later; for Chainguard packages upgrade openjdk-11-openj9 and related variants to 0.53.0-r0; rebuild and redeploy container images incorporating the fixed kernel; apply network filtering to drop suspicious IPv6 extension header combinations where feasible.

How to confirm the fix worked

Confirm kernel version contains commit 5dc60b2a00ed7629214ac0c48e43f40af2078703; verify absence of the skb_reset_transport_header warning in dmesg during GSO processing; test with syzkaller-style IPv6 GSO fuzzing to ensure no overflow occurs.

Typical attack path

1. Craft IPv6 packet containing excessively long extension headers
2. Trigger GSO segmentation via normal or accelerated transmit path (skb_gso_segment)
3. Cause skb_reset_transport_header to write beyond 16-bit field range
4. Exploit resulting memory corruption for denial of service or elevation of privilege within container boundaries

How to detect it

Search kernel logs for the exact warning "WARNING: CPU: .* at .* skb_reset_transport_header" combined with "ipv6_gso_segment"; inspect auditd or container runtime logs for anomalous GSO-related processes or syz-executor-style executors; correlate with network flows containing unusually long IPv6 extension headers.

• WARNING: CPU: .* at .* skb_reset_transport_header include/linux/skbuff.h:3032
• ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151
• syz-executor
• skb_reset_transport_header_careful

What your security team should do

• Prioritize kernel upgrades on all container-optimized hosts within the next 7 days given listed threat-actor activity
• Scan container registries for images still using pre-5dc60b2a00ed kernels and block deployment
• Enable IPv6 extension header length validation at network edge devices
• Monitor for container breakout attempts tied to the listed privilege-escalation campaigns