xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value. __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.
CVE-2025-39965
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-39965
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3d8090bb53424432fa788fe9a49e8ceca74f0544",
"lessThan": "0baf92d0b1590b903c1f4ead75e61715e50e8146",
"versionType": "git"
},
{
"status": "affected",
"version": "2fc5b54368a1bf1d2d74b4d3b8eea5309a653e38",
"lessThan": "9fcedabaae0096f712bbb4ccca6a8538af1cd1c8",
"versionType": "git"
},
{
"status": "affected",
"version": "29e9158f91f99057dbd35db5e8674d93b38549fe",
"lessThan": "a78e55776522373c446f18d5002a8de4b09e6bf7",
"versionType": "git"
},
{
"status": "affected",
"version": "94f39804d891cffe4ce17737d295f3b195bc7299",
"lessThan": "cd8ae32e4e4652db55bce6b9c79267d8946765a9",
"versionType": "git"
},
{
"status": "affected",
"version": "c67d4e7a8f90fb6361ca89d4d5c9a28f4e935e47",
"versionType": "git"
},
{
"status": "affected",
"version": "6.15.11",
"lessThan": "6.16",
"versionType": "semver"
}
],
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6.103",
"lessThan": "6.6.109",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.12.43",
"lessThan": "6.12.50",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.16.2",
"lessThan": "6.16.10",
"versionType": "semver"
}
],
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2025-39965
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30647 · Revision 1
- Added to Heist Feed
- Publisher date