Duplicate SPI Handling Vulnerability in Linux Kernel
Summary
CVE-2025-39797: In the Linux kernel, the following vulnerability has been resolved: xfrm: Duplicate SPI Handling The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI Netlink message, which triggers the kernel function xfr... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and facilitating communication between hardware and software. It provides essential services such as process management, memory management, and device control. The kernel's networking stack includes support for IPsec, which uses Security Parameter Index (SPI) for managing secure communications. This vulnerability affects the kernel's handling of SPI, potentially leading to security issues in network communications.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified related to the handling of Security Parameter Index (SPI) in the xfrm subsystem. When Strongswan initiates an XFRM_MSG_ALLOCSPI Netlink message, the kernel function xfrm_alloc_spi() is called to allocate a unique SPI for inbound Security Associations (SAs). However, this function can erroneously succeed even when the requested SPI is already in use, resulting in duplicate SPIs being assigned to multiple inbound SAs. This inconsistency can lead to packet processing failures and dropped packets, as the kernel may return an arbitrary SA during SPI lookups. The issue can be reliably reproduced by restricting the SPI range in the configuration file, leading to predictable duplicate SPI assignments.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
To work around this issue, you can restrict the available SPI range in the Strongswan configuration file (charon.conf) as follows: spi_min = 0x10000000 spi_max = 0x10000002. This will limit the system to only 2 usable SPI values, but be aware that this may lead to duplicate SPI assignments if more than 2 Child SAs are created.
Conclusion
The Duplicate SPI Handling vulnerability in the Linux kernel poses significant risks to secure network communications by allowing duplicate SPIs to be assigned. It is crucial to update to the patched versions of the Linux package to mitigate these risks. Users should also consider implementing the provided workaround if immediate updates are not feasible.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to packet processing failures and dropped packets due to inconsistent SPI lookups, which may compromise secure communications.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The vulnerability affects the Linux kernel in Debian versions 11, 12, 13, and 14, with specific fixed versions available for Debian 13 (6.12.43-1) and Debian 14 (6.16.3-1).
If immediate updates are not possible, consider applying the workaround by restricting the SPI range in your configuration file to minimize the risk of duplicate SPI assignments.
Detailed information about the vulnerability can be found in the CVE report for CVE-2025-39797, which outlines the technical aspects and implications of the issue.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
