CVE-2025-39852: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39852 is a memory leak vulnerability discovered in the Linux kernel's TCP Authentication Option (TCP-AO) handling for IPv6. The vulnerability was disclosed on September 19, 2025, affecting the net/tcp subsystem specifically in the TCP-AO failure handling mechanism for IPv6 connections (NVD).

The vulnerability occurs when tcpaocopyallmatching() fails in tcpv6synrecvsock(), causing the function to exit without proper cleanup. This results in a memory leak of approximately 2496 bytes per occurrence. The issue stems from the lack of proper error handling, specifically the absence of calls to inetcskprepareforcedclose() and tcp_done() which are necessary for proper memory cleanup (NVD).

The vulnerability leads to memory leaks in the kernel space, which over time could result in system resource depletion. The leaked memory remains allocated but unreferenced, potentially affecting system performance and stability (NVD).

The vulnerability has been fixed in Linux kernel version 6.12.48-1. The fix ensures that tcpv4synrecvsock and tcpv6synrecvsock have similar error-handling mechanisms by implementing proper cleanup procedures (Debian Security).