Log in Start free

Vulnerability · Published Oct 13, 2025 · Assigned by Linux

CVE-2025-39965xfrm: xfrm_alloc_spi shouldn't use 0 as SPI

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 90.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value. __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13linux6.12.57-1DEBIAN-CVE-2025-39965
Debian:14linux6.16.10-1DEBIAN-CVE-2025-39965
Ubuntu:24.04:LTSlinux6.8.0-106.106UBUNTU-CVE-2025-39965
Ubuntu:25.10linux6.17.0-6.6UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-aws6.8.0-1050.53UBUNTU-CVE-2025-39965
Ubuntu:25.10linux-aws6.17.0-1003.3UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1050.53~22.04.1UBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-azure6.8.0-1051.57UBUNTU-CVE-2025-39965
Ubuntu:25.10linux-azure6.17.0-1006.6UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-39965
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-gcp6.8.0-1052.55UBUNTU-CVE-2025-39965
Ubuntu:25.10linux-gcp6.17.0-1003.3UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1052.55~22.04.1UBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-gke6.8.0-1048.53UBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1035.38UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-106.106~22.04.1UBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-ibm6.8.0-1049.49UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1049.49~22.04.1UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-106.106.1UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-106.106.1~22.04.1UBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1049.52UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1049.52~22.04.1UBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1049.52.1UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-oracle6.8.0-1047.48UBUNTU-CVE-2025-39965
Ubuntu:25.10linux-oracle6.17.0-1003.3UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1047.48~22.04.1UBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-raspi6.8.0-1050.54UBUNTU-CVE-2025-39965
Ubuntu:25.10linux-raspi6.17.0-1004.4UBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-39965
Ubuntu:25.10linux-realtime6.17.0-1002.3UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-39965
Ubuntu:25.10linux-riscv6.17.0-6.6.1UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-106.106~22.04.1UBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-39965
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-39965
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1028.29UBUNTU-CVE-2025-39965

Affected products (as reported)

VendorProductVersions
Linux Linux 3d8090bb53424432fa788fe9a49e8ceca74f0544 – before 0baf92d0b1590b903c1f4ead75e61715e50e81462fc5b54368a1bf1d2d74b4d3b8eea5309a653e38 – before 9fcedabaae0096f712bbb4ccca6a8538af1cd1c829e9158f91f99057dbd35db5e8674d93b38549fe – before a78e55776522373c446f18d5002a8de4b09e6bf794f39804d891cffe4ce17737d295f3b195bc7299 – before cd8ae32e4e4652db55bce6b9c79267d8946765a9fb58962aa3b9359988c7b5b15a971fd9ad5b0ecdc67d4e7a8f90fb6361ca89d4d5c9a28f4e935e476.1.191 – before 6.26.15.11 – before 6.16
Linux Linux 6.6.103 – before 6.6.1096.12.43 – before 6.12.506.16.2 – before 6.16.10

References