CVE-2025-39965

mediumpriority · track · 32EPSS 0.002 · 9 %ileexploit · PoCDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

0.20% (9th) EPSS

CVSS 5.5 · medium

Is it mine?

38 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-22

In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value. __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedkernel-obs-build-0:6.12.0-160000.7.1.aarch64 as component of SUSE Linux Micro Extras 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedkernel-obs-build-0:6.12.0-160000.7.1.ppc64le as component of SUSE Linux Micro Extras 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedkernel-obs-build-0:6.12.0-160000.7.1.s390x as component of SUSE Linux Micro Extras 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedkernel-obs-build-0:6.12.0-160000.7.1.x86_64 as component of SUSE Linux Micro Extras 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedkernel-syms-0:6.12.0-160000.7.1.aarch64 as component of SUSE Linux Micro Extras 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedkernel-syms-0:6.12.0-160000.7.1.ppc64le as component of SUSE Linux Micro Extras 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedkernel-syms-0:6.12.0-160000.7.1.s390x as component of SUSE Linux Micro Extras 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedkernel-syms-0:6.12.0-160000.7.1.x86_64 as component of SUSE Linux Micro Extras 6.2suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.2–7.8

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 3.6

v3.15.5mediumAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 1.8 · impact 5.9

v3.15.2mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.16.6mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Hsecondary · SUSE Product Security

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-416US

exploits (1)

Public proof-of-concept and weaponised exploit code.

Shreyas-Penkar/CVE-2025-39965PoC for CVE-2025-39965PoC · poc_in_github

affected products (38)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Dell Avamarall versionscert_bundDEcpe:/a:dell:avamar:-
Dell NetWorkerall versionscert_bundDEcpe:/a:dell:networker:-
Google Cloud Platformall versionscert_bundDEcpe:/a:google:cloud_platform:-
Open Source Linux Kernelall versionscert_bundDEcpe:/o:linux:linux_kernel:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Siemens SIMATIC S7 1500 CPUall versionscert_bundDEcpe:/h:siemens:simatic_s7:1500_cpu
Ubuntu Linuxall versionscert_bundDEcpe:/o:canonical:ubuntu_linux:-
Dell Dell NetWorker vProxy <19.14≤ vProxy <19.14cert_bundDE
Dell Networker≤ vProxy <19.14cert_bundDE
Linux Linux≤ c67d4e7a8f90…enisa_euvdEU
Linux Linux29e9158f91f9… → a78e55776522…enisa_euvdEU
Linux Linux2fc5b54368a1… → 9fcedabaae00…enisa_euvdEU
Linux Linux3d8090bb5342… → 0baf92d0b159…enisa_euvdEU
Linux Linux6.12.43 → 6.12.50enisa_euvdEU

showing 20 of 38

advisories (2)

Vendor and ecosystem advisories describing this.

SUSE-SU-2026:20561-1Security update for the Linux Kernel2025-11-26csaf · suse_csafDE
Security update for the Linux Kernel
WID-SEC-W-2025-2268Linux Kernel: Mehrere SchwachstellenDeutsch2025-10-13csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um Daten zu manipulieren oder einen Denial of Service herbeizuführen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund suse_csaf NVD CVE.org MITRE

published 2025-10-13modified 2026-10-19

references (13)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan