In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value. __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/0baf92d0b1590b903c1f4ead75e61715e50e8146 cve-icon cve-icon
https://git.kernel.org/stable/c/9fcedabaae0096f712bbb4ccca6a8538af1cd1c8 cve-icon cve-icon
https://git.kernel.org/stable/c/a78e55776522373c446f18d5002a8de4b09e6bf7 cve-icon cve-icon
https://git.kernel.org/stable/c/cd8ae32e4e4652db55bce6b9c79267d8946765a9 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025101336-CVE-2025-39965-9772@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-39965 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-39965 cve-icon
History

Mon, 20 Oct 2025 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Tue, 14 Oct 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Mon, 13 Oct 2025 14:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value. __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.
Title xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-10-13T13:48:31.033Z

Updated: 2025-10-13T13:48:31.033Z

Reserved: 2025-04-16T07:20:57.149Z

Link: CVE-2025-39965

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-10-13T14:15:34.910

Modified: 2025-10-14T19:36:29.240

Link: CVE-2025-39965

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-10-13T00:00:00Z

Links: CVE-2025-39965 - Bugzilla