Linux Kernel Vulnerability in XFRM SPI Management

CVE-2025-39965

What is CVE-2025-39965?

A vulnerability exists in the Linux kernel related to the xfrm subsystem where the SPI (Security Parameter Index) is incorrectly managed. The issue arises when a state is assigned a SPI value of 0, which signifies 'no SPI assigned'. Due to a previous commit, states created with this value inadvertently remain in the byspi list. The __xfrm_state_delete function fails to remove these states during list traversal, leading to a potential Use-After-Free condition. This flaw may allow an attacker to exploit memory that has already been freed, resulting in undefined behavior or system compromise.

References