CVE-2025-38675: xfrm: state: initialize state_ptrs earlier in xfrm_state_find
In the Linux kernel, the following vulnerability has been resolved:
xfrm: state: initialize stateptrs earlier in xfrmstatefind
In case of preemption, xfrmstatelookat will find a different pcpuid and look up states for that other CPU. If we matched a state for CPU2 in the statecache while the lookup started on CPU1, we will jump to "found", but the "best" state that we got will be ignored and we will enter the "acquire" block. This block uses stateptrs, which isn't initialized at this point.
Let's initialize stateptrs just after taking rcureadlock. This will also prevent a possible misuse in the future, if someone adjusts this function.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-38675?
The severity of CVE-2025-38675 is currently assessed as high due to potential state corruption in the Linux kernel.
How do I fix CVE-2025-38675?
To fix CVE-2025-38675, upgrade to the latest version of the Linux kernel that includes the necessary patches.
What are the potential impacts of CVE-2025-38675?
CVE-2025-38675 may lead to unexpected behavior or security vulnerabilities in kernel-level state management.
Which versions of the Linux kernel are affected by CVE-2025-38675?
CVE-2025-38675 affects multiple versions of the Linux kernel prior to the release of the fix that addresses the vulnerability.
Is CVE-2025-38675 being actively exploited?
As of now, there is no public evidence indicating active exploitation of CVE-2025-38675 in the wild.