CVE-2025-39702
A critical flaw in the Linux kernel allows attackers to exploit timing differences when comparing MAC addresses in IPv6 routing. The vulnerability can lead to full compromise of confidentiality, integrity, and availability. It has been fixed in recent kernel releases.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, including version 6.17 and Debian Linux 11.0. Users running older kernels are at risk.
Real-world impact
An attacker could use the timing differences to deduce MAC addresses and potentially gain full control over the affected system, compromising data confidentiality, integrity, and availability.
Why this severity
The CVSS score of 9.8 reflects the lack of authentication or user interaction required, the high impact on confidentiality, integrity, and availability, and the ability to exploit the flaw remotely with no special privileges.
What to do about it
- 01Upgrade the Linux kernel to version 6.17 or later.
- 02Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Sep 5, 2025 · Sep 5, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/3b348c9c8d2ca2c675…patch
- git.kernel.org/stable/c/3ddd55cf19ed6cc62d…patch
- git.kernel.org/stable/c/86b6d34717fe0570af…patch
- git.kernel.org/stable/c/a458b2902115b26a25…patch
- git.kernel.org/stable/c/b3967c493799e63f64…patch
- git.kernel.org/stable/c/f7878d47560d61e3f3…patch
- git.kernel.org/stable/c/ff55a452d56490047f…patch
- lists.debian.org/debian-lts-announce/2025/10…mailing listthird party advisory
- cert-portal.siemens.com/productcert/html/ssa-032379…