CVE-2025-39965: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
In the Linux kernel, the following vulnerability has been resolved:
xfrm: xfrmallocspi shouldn't use 0 as SPI
x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value.
xfrmstatedelete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39965?
CVE-2025-39965 has a severity rating that prompts users to assess their systems for potential security risks.
How do I fix CVE-2025-39965?
To fix CVE-2025-39965, update your Linux kernel to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2025-39965?
CVE-2025-39965 affects various versions of the Linux kernel where the xfrm functionality is implemented.
What is the impact of CVE-2025-39965?
The impact of CVE-2025-39965 may lead to security issues related to improper SPI handling in networking components.
When was CVE-2025-39965 reported?
CVE-2025-39965 was identified and reported following updates to the Linux kernel's xfrm component.