Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash or potentially gain unauthorized access. The issue occurs in the IPsec (XFRM) subsystem, which manages secure network communications. An attacker could exploit this to disrupt system operations or compromise data integrity.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's XFRM (IPsec) subsystem within the xfrm_alloc_spi function. The root cause is that the kernel incorrectly allows a Security Parameter Index (SPI) value of 0 to be assigned and added to the 'byspi' list. Because an SPI of 0 is internally interpreted as 'no SPI assigned,' the __xfrm_state_delete function fails to remove these states from the list during cleanup. Subsequent traversal of the 'byspi' list then encounters pointers to freed memory. This can be triggered by a local attacker with sufficient privileges to manage XFRM states, leading to a system crash or arbitrary code execution. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux Kernel 6.6.103 to 6.6.109, 6.12.43 to 6.12.50, 6.15.11 to 6.16, 6.16.2 to 6.16.10
Timeline
- 2025-08-29: other: Vulnerability fix authored
- 2025-10-02: patched: Patches committed to stable trees
- 2025-10-13: disclosed: CVE-2025-39965 published