CVE-2025-39965

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-39965
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-39965.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-39965
Downstream
Related
Published
2025-10-13T13:48:31.033Z
Modified
2026-03-12T02:18:51.920140Z
Summary
xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
Details

In the Linux kernel, the following vulnerability has been resolved:

xfrm: xfrmallocspi shouldn't use 0 as SPI

x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value.

__xfrmstatedelete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39965.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3d8090bb53424432fa788fe9a49e8ceca74f0544
Fixed
0baf92d0b1590b903c1f4ead75e61715e50e8146
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
2fc5b54368a1bf1d2d74b4d3b8eea5309a653e38
Fixed
9fcedabaae0096f712bbb4ccca6a8538af1cd1c8
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
29e9158f91f99057dbd35db5e8674d93b38549fe
Fixed
a78e55776522373c446f18d5002a8de4b09e6bf7
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
94f39804d891cffe4ce17737d295f3b195bc7299
Fixed
cd8ae32e4e4652db55bce6b9c79267d8946765a9
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c67d4e7a8f90fb6361ca89d4d5c9a28f4e935e47

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-39965.json"