Linux Kernel Vulnerability in af_alg Functionality

CVE-2025-39931

What is CVE-2025-39931?

A vulnerability in the Linux kernel's af_alg functionality arises due to improper handling of the ctx->merge variable. If an error occurs during the execution of af_alg_sendmsg, this variable may retain a garbage value. This can lead to a system crash on subsequent calls to af_alg_sendmsg when an invalid merge operation is attempted. To mitigate this issue, it is essential to reset ctx->merge to zero at the beginning of the loop, ensuring stability and reliability in handling cryptographic operations.

References