CVE-2025-39965
MEDIUMLinux Kernel 6.6.103-6.6.108 - Use-After-Free in xfrm_state_delete
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2025-39965. PoCs published by Shreyas-Penkar.
AI-analyzed exploit summary This repository contains a functional proof-of-concept exploit for CVE-2025-39965, targeting a vulnerability in the Linux XFRM subsystem. The PoC includes code to allocate, query, and delete XFRM security associations (SAs) via Netlink, demonstrating the vulnerability's exploitation mechanism.
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value. __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list.
Exploits (1)
This repository contains a functional proof-of-concept exploit for CVE-2025-39965, targeting a vulnerability in the Linux XFRM subsystem. The PoC includes code to allocate, query, and delete XFRM security associations (SAs) via Netlink, demonstrating the vulnerability's exploitation mechanism.
References (4)
Scores
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H