Back
CVE-2025-39702ipv6: sr: Fix MAC comparison to be constant-time
- 9.8CriticalCVSS base score
- 0.45%Exploitation in 30 daysEPSS · top 60% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
Timeline
ID reserved
By Linux
- 5 months later
· 5 months later
Published
- 14 months later
· 14 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High7.0 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.45% · top 60% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected bf355b8d2c30a289232042cacc1cfaea4923936c – < ff55a452d56490047f5233cc48c5d933f8586884
- affected bf355b8d2c30a289232042cacc1cfaea4923936c – < 3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0
- affected bf355b8d2c30a289232042cacc1cfaea4923936c – < 86b6d34717fe0570afce07ee79b8eeb40341f831
- affected bf355b8d2c30a289232042cacc1cfaea4923936c – < 3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3
- affected bf355b8d2c30a289232042cacc1cfaea4923936c – < b3967c493799e63f648e9c7b6cb063aa2aed04e7
- affected bf355b8d2c30a289232042cacc1cfaea4923936c – < f7878d47560d61e3f370aca3cebb8f42a55b990a
- affected bf355b8d2c30a289232042cacc1cfaea4923936c – < a458b2902115b26a25d67393b12ddd57d1216aaa
- affected 4.10
- unaffected < 4.10
- unaffected 5.10.249 – ≤ 5.10.*
- unaffected 5.15.190 – ≤ 5.15.*
- unaffected 6.1.149 – ≤ 6.1.*
- unaffected 6.6.103 – ≤ 6.6.*
- unaffected 6.12.44 – ≤ 6.12.*
- unaffected 6.16.4 – ≤ 6.16.*
- unaffected 6.17 – ≤ *
References
References9
- https://git.kernel.org/stable/c/ff55a452d56490047f5233cc48c5d933f8586884 (opens in a new tab)
- https://git.kernel.org/stable/c/3b348c9c8d2ca2c67559ffd0e258ae7e1107d4f0 (opens in a new tab)
- https://git.kernel.org/stable/c/86b6d34717fe0570afce07ee79b8eeb40341f831 (opens in a new tab)
- https://git.kernel.org/stable/c/3ddd55cf19ed6cc62def5e3af10c2a9df1b861c3 (opens in a new tab)
- https://git.kernel.org/stable/c/b3967c493799e63f648e9c7b6cb063aa2aed04e7 (opens in a new tab)
- https://git.kernel.org/stable/c/f7878d47560d61e3f370aca3cebb8f42a55b990a (opens in a new tab)
- https://git.kernel.org/stable/c/a458b2902115b26a25d67393b12ddd57d1216aaa (opens in a new tab)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2025-31524 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2025-39702)Record last updated .