CVE-2025-39965: CVE-2025-39965: In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi …
linux · linux kernel · NVD published 2025-10-13 · posted 2025-10-17 · last modified 2026-10-20
What it is
In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value. __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.
| Weakness | Not specified |
|---|---|
| CVSS vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (source: [email protected]) |
| ATT&CK tactics | n/a |
Exploitation evidence
First exploit evidence seen: 2025-10-17 (earliest date across the sources below).
Exploited in the wild
No source on this site lists in-the-wild exploitation yet (CISA KEV, VulnCheck KEV).
Public exploit code
GitHub proof-of-concept repositories
1 public repositories from 1 accounts, first seen 2025-10-17. Most starred: Shreyas-Penkar/CVE-2025-39965 (10 stars), view repository.
Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.
Sources: nomi-sec/PoC-in-GitHub.
How to fix it
Fixed versions
- linux linux kernel: upgrade to 6.6.109 or later (affected from 6.6.103)
- linux linux kernel: upgrade to 6.12.50 or later (affected from 6.12.43)
- linux linux kernel: upgrade to 6.16 or later (affected from 6.15.11)
- linux linux kernel: upgrade to 6.16.10 or later (affected from 6.16.2)
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
- https://git.kernel.org/stable/c/0baf92d0b1590b903c1f4ead75e61715e50e8146 (Patch)
- https://git.kernel.org/stable/c/9fcedabaae0096f712bbb4ccca6a8538af1cd1c8 (Patch)
- https://git.kernel.org/stable/c/a78e55776522373c446f18d5002a8de4b09e6bf7 (Patch)
- https://git.kernel.org/stable/c/cd8ae32e4e4652db55bce6b9c79267d8946765a9 (Patch)
Detection Generic guidance
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.