CVE-2025-39965

A use-after-free flaw was found in the Linux kernel IPsec subsystem in the way Security Parameter Indexes (SPI) are allocated and tracked. States created with an SPI value of 0 were added to the per-SPI list, and later deletion paths did not remove them from that list. A local user with the ability to configure IPsec could use this flaw to crash the system, resulting in a denial of service.

In XFRM state management, xfrm_alloc_spi() treated SPI 0 as a usable value and inserted such states into the byspi list. Since SPI 0 semantically means “no SPI assigned,” subsequent delete paths did not unlink these entries, leaving stale list nodes. Iteration over byspi could then access freed memory, leading to a use-after-free and kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module xfrm_user from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.