AI description
CVE-2025-39965 is a use-after-free (UAF) vulnerability in the Linux kernel's XFRM subsystem, which is responsible for implementing the IPsec protocol. The vulnerability stems from the `xfrm_alloc_spi` function in the `net/xfrm/xfrm_state.c` file. This function, which is called via the `XFRM_MSG_ALLOCSPI` Netlink message from user space, is responsible for allocating SPIs (Security Parameter Indexes). A recent commit modified the allocation logic to prevent SPI duplication. However, the `get_random_u32_inclusive` function can return 0, which isn't checked by `xfrm_alloc_spi`. As a result, an `xfrm_state` object can be allocated with an SPI value of 0 and added to the `byspi` global list. Since SPI=0 typically signifies that no SPI is assigned, the `__xfrm_state_delete` function doesn't remove such objects from the `byspi` list when cleaning up. This leaves a dangling pointer in the `byspi` list, leading to a use-after-free condition when the memory is accessed again.
- Description
- In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value. __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- NVD status
- Analyzed
- Products
- linux_kernel
CVSS 3.1
- Type
- Primary
- Base score
- 7.8
- Impact score
- 5.9
- Exploitability score
- 1.8
- Vector string
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- Hype score
- Not currently trending
Analysis of a Use-After-Free in the Linux XFRM subsystem (CVE-2025-39965) by @streypaws https://t.co/ZWOVtBV6Jg #infosec #Linux https://t.co/ecRglI9kF2
@0xor0ne
1 Jan 2026
5921 Impressions
15 Retweets
100 Likes
55 Bookmarks
0 Replies
0 Quotes
CVE-2025-39965: UAF in Linux Kernel XFRM https://t.co/i8R2Frasny A July fix for duplicate SPI allocation introduced a UAF vulnerability in the IPsec XFRM subsystem:
@hackyboiz
26 Oct 2025
4367 Impressions
10 Retweets
47 Likes
19 Bookmarks
0 Replies
1 Quote
I analysed a recent KernelCTF 1-Day (CVE-2025-39965) which is a UaF in Linux XFRM subsystem, including the XFRM internals, the patch-fix, vulnerability analysis, along with a trigger PoC. Enjoy! Blog: https://t.co/IhfKiGAmkZ PoC: https://t.co/EHtvcD9gNn
@streypaws
19 Oct 2025
6702 Impressions
24 Retweets
102 Likes
42 Bookmarks
0 Replies
0 Quotes
CVE-2025-39965 In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since co… https://t.co/KNoufAyiRm
@CVEnew
13 Oct 2025
367 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A33D59EB-F9EC-4F4A-B85C-8B9DF77F0CBE",
"versionEndExcluding": "6.6.109",
"versionStartIncluding": "6.6.103"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D946BB01-10F6-44C7-A2E5-672C4B746920",
"versionEndExcluding": "6.12.50",
"versionStartIncluding": "6.12.43"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "53FE35DC-2528-48D7-A855-1127CA02EE4D",
"versionEndExcluding": "6.16",
"versionStartIncluding": "6.15.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EDE9892A-2523-424A-8D02-DFCE8B965230",
"versionEndExcluding": "6.16.10",
"versionStartIncluding": "6.16.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5A4516A6-C12E-42A4-8C0E-68AEF3264504"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3963C3A0-CEA1-4F5C-8011-3A593ABB684D"
}
],
"operator": "OR"
}
]
}
]