PoC Index85,101 CVEs with PoCs

CVE-2025-39965

xfrm: xfrm_alloc_spi shouldn't use 0 as SPI

MEDIUM 5.5EPSS 0.2%

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value. __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.

Affected
Linux
CVSS v3.1 NVD
5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v3.1 CNA
7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
0.20% chance of exploitation in the next 30 days, 9th percentile
Published
2025-10-13
Updated
2026-10-15

Proof-of-concept exploits (1)

Exploit collections (1)

Security advisories

References

Related