NetSight
IP …
high7.8

CVE-2025-39965

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but sin…

Impact

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value. __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 6.6.103 before 6.6.109
from 6.12.43 before 6.12.50
from 6.15.11 before 6.16
from 6.16.2 before 6.16.10
Version 6.17

References