CVE-2025-39797

high

Published 2026-07-28 · Modified 2026-07-28

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

8.0

Description

RHSA-2026:47040: kernel security, bug fix, and enhancement update (Important)

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Red Hat Errata — Red Hat Inc. · View original ↗ · Open-Errata-API

Description kernel: xfrm: Duplicate SPI Handling Red Hat statement The patch fixes a logic flaw in XFRM SPI allocation where xfrm_alloc_spi() could succeed even if the requested SPI was already in use on another inbound SA (different dst). That lets multiple inbound SAs share the same SPI+proto, so inbound lookups may hit the “wrong” SA or none at all, causing IPsec packet drops (DoS). It’s…

Description

kernel: xfrm: Duplicate SPI Handling

Red Hat statement

The patch fixes a logic flaw in XFRM SPI allocation where xfrm_alloc_spi() could succeed even if the requested SPI was already in use on another inbound SA (different dst). That lets multiple inbound SAs share the same SPI+proto, so inbound lookups may hit the “wrong” SA or none at all, causing IPsec packet drops (DoS). It’s reliably reproducible by constraining the SPI range (e.g., 0x10000000–0x10000002) and creating more Child SAs than available SPIs. The main risk is remote DoS. Triggering this issue requires interaction at the IKE/IPsec control plane — it can only be exercised when an IKE daemon (for example strongSwan, LibreSwan, racoon or OpenSwan) is present and issues XFRM (netlink) requests to create SAs.

CVSS v3: 5.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Errata / fixed releases

Product	Package	Advisory	Released
Red Hat Enterprise Linux 10	`kernel-0:6.12.0-211.7.1.el10_2`	RHSA-2026:18134	2026-05-19T00:00:00Z

Package state

Product	Package	State
Red Hat Enterprise Linux 6	`kernel`	Out of support scope
Red Hat Enterprise Linux 7	`kernel`	Fix deferred
Red Hat Enterprise Linux 7	`kernel-rt`	Fix deferred
Red Hat Enterprise Linux 8	`kernel`	Fix deferred
Red Hat Enterprise Linux 8	`kernel-rt`	Fix deferred
Red Hat Enterprise Linux 9	`kernel`	Affected
Red Hat Enterprise Linux 9	`kernel-rt`	Fix deferred

Apply commands

bash fix

Apply RHSA-2026:18134 for Red Hat Enterprise Linux 10

yum update -y kernel
# or:
dnf upgrade -y kernel

Affected

Vendor	Product	Version
redhat	Red Hat Enterprise Linux 9	`Affected`

OS impact

SUSE Affected 1 release

Version	Status	Fixed in
—	Affected	—

Debian Mixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`6.12.43-1`
sid	Fixed	`6.16.3-1`
forky	Fixed	`6.16.3-1`
bullseye	Affected	—
bookworm	Affected	—

Red Hat Fixed 1 release

Version	Status	Fixed in
9	Fixed	—

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.