Security tracker / CVE-2025-39965

CVE-2025-39965

xfrm: xfrm_alloc_spi shouldn't use 0 as SPI

References

• Debian security tracker
• cve.org

Notes

 carnil> Introduced in 94f39804d891 ("xfrm: Duplicate SPI Handling"). Vulnerable
 carnil> versions: 6.6.103 6.12.43 6.15.11 6.16.2 6.17.

Bugs

Status

Branch	Status
upstream	released (6.17) [cd8ae32e4e4652db55bce6b9c79267d8946765a9]
7.2-upstream-stable	N/A "Fixed before branching point"
6.18-upstream-stable	N/A "Fixed before branching point"
6.16-upstream-stable	released (6.16.10) [a78e55776522373c446f18d5002a8de4b09e6bf7]
6.12-upstream-stable	released (6.12.50) [9fcedabaae0096f712bbb4ccca6a8538af1cd1c8]
6.6-upstream-stable	released (6.6.109) [0baf92d0b1590b903c1f4ead75e61715e50e8146]
6.1-upstream-stable	needed
5.10-upstream-stable	N/A "Vulnerable code not present"
sid	released (6.16.10-1)
6.12-trixie-security	released (6.12.57-1)
6.1-bookworm-security	N/A "Vulnerable code not present"
5.10-bullseye-security	N/A "Vulnerable code not present"