CVE-2025-39965: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability was discovered in the Linux kernel's XFRM subsystem (CVE-2025-39965), identified on October 13, 2025. The issue relates to improper handling of Security Parameter Index (SPI) values in the xfrm_alloc_spi function, where states with SPI value 0 are incorrectly added to the byspi list (NVD).

The vulnerability stems from a change introduced by commit 94f39804d891 ("xfrm: Duplicate SPI Handling") that allows creation of states with x->id.spi == 0 and adds them to the byspi list. However, this value is meant to indicate "no SPI assigned". The __xfrm_state_delete function does not remove these states from the byspi list since they shouldn't be there, leading to a Use-After-Free (UAF) condition when traversing the byspi list (NVD).

The vulnerability affects the Linux kernel's XFRM subsystem, which is crucial for IPsec implementation. The Use-After-Free condition could potentially lead to memory corruption and system instability (NVD).

Ubuntu has released patches for affected systems, specifically for version 25.10 (Questing). The fix involves updating to kernel version 6.17.0-6.6 or later. Similar updates have been released for AWS and GCP-specific kernel versions (Ubuntu).