CVE-2025-39965

CVE-2025-39965 is a use-after-free (UAF) vulnerability in the Linux kernel's XFRM subsystem, which is responsible for implementing the IPsec protocol. The vulnerability stems from the `xfrm_alloc_spi` function in the `net/xfrm/xfrm_state.c` file. This function, which is called via the `XFRM_MSG_ALLOCSPI` Netlink message from user space, is responsible for allocating SPIs (Security Parameter Indexes). A recent commit modified the allocation logic to prevent SPI duplication. However, the `get_random_u32_inclusive` function can return 0, which isn't checked by `xfrm_alloc_spi`. As a result, an `xfrm_state` object can be allocated with an SPI value of 0 and added to the `byspi` global list. Since SPI=0 typically signifies that no SPI is assigned, the `__xfrm_state_delete` function doesn't remove such objects from the `byspi` list when cleaning up. This leaves a dangling pointer in the `byspi` list, leading to a use-after-free condition when the memory is accessed again.