LiveActive security incident?Get immediate response
CVE Record

CVE-2025-39802: lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts

In the Linux kernel, the following vulnerability has been resolved: lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts Restore the SIMD usability check that was removed by commit 773426f4771b ("crypto: arm/poly1305 - Add block-only interface"). This safety check is cheap and is well worth eliminating a footgun. While the Poly1305 functions should not be called when SIMD registers are unusable, if they are anyway, they should just do the right thing instead of corrupting random tasks' registers and/or computing incorrect MACs. Fixing this is also needed for poly1305_kunit to pass. Just use may_use_simd() instead of the original crypto_simd_usable(), since poly1305_kunit won't rely on crypto_simd_disabled_for_test.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux kernel flaw in ARM Poly1305 processing can corrupt processor registers or calculate incorrect authentication codes when invoked while SIMD registers are unavailable. This may disrupt unrelated tasks and cause system instability. The supplied CVSS assessment emphasizes remotely reachable denial-of-service risk, although successful triggering depends on the affected code path and runtime context.

Executive priority

Treat this as a high-priority availability issue for affected ARM Linux estates, especially systems supporting critical or exposed services. Patch through normal emergency or accelerated kernel-maintenance procedures after confirming vendor applicability. Broader crisis response is not supported by the supplied evidence because active exploitation has not been established.

Technical view

A removed SIMD-usability check allowed ARM Poly1305 functions to run in unsafe no-SIMD contexts. This can corrupt other tasks’ registers or produce incorrect MACs. The resolution restores the check using may_use_simd(). The supplied record assigns CVSS 3.1 score 7.5 with network access, low complexity, no privileges, no interaction, and high availability impact.

Likely exposure

Exposure is limited to affected Linux kernel versions on ARM systems using the relevant Poly1305 implementation. The bundle identifies Linux 6.16 through the stated fixed-version boundaries, but its version-range representation is ambiguous. Distribution backports may change practical exposure, so kernel build and vendor advisory status must be verified.

Exploitation context

The supplied bundle does not identify public exploitation, proof-of-concept availability, or inclusion in CISA KEV. Triggering requires Poly1305 execution when SIMD registers are unusable, a context the code ordinarily should avoid. CVSS labels the attack vector as network-accessible, but the bundle does not describe a confirmed remote attack path.

Researcher notes

The defect was introduced when commit 773426f4771b removed a SIMD-usability check while adding a block-only interface. The fix restores runtime gating with may_use_simd(). Potential effects include cross-task register corruption and incorrect MAC calculation. The source bundle provides no CWE, exploit evidence, affected architecture detail beyond ARM, or precise triggering protocol.

Mitigation direction

  • Upgrade to a vendor-supported kernel containing the referenced upstream or stable fix.
  • Confirm distribution backports because package versions may not match upstream kernel numbering.
  • Review vendor guidance if an updated kernel is not yet available.
  • Prioritize affected internet-facing or availability-critical ARM systems.

Validation and detection

  • Inventory ARM systems and record their running kernel builds.
  • Compare each build against vendor advisories and the referenced stable commits.
  • Confirm the deployed kernel includes the restored may_use_simd() safety check.
  • Run approved regression tests covering Poly1305 and no-SIMD contexts after updating.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-39802 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2025-39802Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux773426f4771bdd82ac5c834bf4c1775315c73a46, 773426f4771bdd82ac5c834bf4c1775315c73a46unaffected
LinuxLinux6.16, 0, 6.16.4, 6.17affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.