Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw in IPsec/XFRM state handling can leave a freed object referenced by an internal list. A local attacker with low privileges may be able to trigger memory corruption, potentially compromising confidentiality, integrity, and availability. Exact exposure depends on kernel lineage and whether the affected XFRM functionality is reachable.
Executive priority
Treat as a high-priority kernel update, especially on shared Linux infrastructure. It is not presented as remotely exploitable or actively exploited, reducing emergency urgency, but successful abuse could have system-wide impact. Confirm vendor exposure and deploy supported fixed kernels through normal expedited patching.
Technical view
Since commit 94f39804d891, XFRM states could enter the SPI lookup list with reserved SPI value zero. State deletion then failed to remove those entries, leaving a stale pointer. A later traversal could cause a use-after-free. The supplied CVSS 3.1 score is 7.8 with local, low-privilege attack requirements.
Likely exposure
Prioritize Linux hosts whose kernels contain the cited regression without a corresponding stable fix. Exposure is local rather than network-direct according to the CVSS vector. Systems using IPsec/XFRM or allowing local users to reach affected kernel paths deserve closer review. The bundle does not provide complete vulnerable version ranges.
Exploitation context
The supplied sources do not report active exploitation, and the CVE is not listed as KEV in the bundle. The vector indicates local access, low privileges, low complexity, and no user interaction. No conclusion about practical exploit reliability or attack prevalence can be made from the provided evidence.
Researcher notes
The defect is a lifecycle inconsistency: SPI zero denotes unassigned state, yet affected code inserted such states into the by-SPI list. Deletion assumed they were absent and skipped unlinking, enabling later use-after-free. The linked stable commits are authoritative remediation references; the supplied metadata does not fully map every vulnerable branch.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the applicable linked stable fix.
- Check distribution advisories for exact package versions and reboot requirements.
- Prioritize multi-user, container-hosting, and XFRM/IPsec-enabled systems pending vendor confirmation.
- Restrict unnecessary local access while affected systems await updates.
Validation and detection
- Record running kernel versions and distribution package release identifiers.
- Compare kernel ancestry against regression commit 94f39804d891 and the applicable fix commit.
- Confirm the corrected kernel is running after update and reboot.
- Review vendor advisories because the bundle lacks complete affected-version ranges.
- Check kernel logs for unexplained XFRM faults or use-after-free reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39965 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0baf92d0b1590b903c1f4ead75e61715e50e8146CVE reference, Linux
- https://git.kernel.org/stable/c/9fcedabaae0096f712bbb4ccca6a8538af1cd1c8CVE reference, Linux
- https://git.kernel.org/stable/c/a78e55776522373c446f18d5002a8de4b09e6bf7CVE reference, Linux
- https://git.kernel.org/stable/c/cd8ae32e4e4652db55bce6b9c79267d8946765a9CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.