CVE-2025-38675

In the Linux kernel, the following vulnerability has been resolved:

xfrm: state: initialize stateptrs earlier in xfrmstate_find

In case of preemption, xfrmstatelookat will find a different pcpuid and look up states for that other CPU. If we matched a state for CPU2 in the statecache while the lookup started on CPU1, we will jump to "found", but the "best" state that we got will be ignored and we will enter the "acquire" block. This block uses stateptrs, which isn't initialized at this point.

Let's initialize stateptrs just after taking rcuread_lock. This will also prevent a possible misuse in the future, if someone adjusts this function.