CVE-2025-39797

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Duplicate SPI Handling

The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI

Netlink message, which triggers the kernel function xfrm_alloc_spi().

This function is expected to ensure uniqueness of the Security Parameter

Index (SPI) for inbound Security Associations (SAs). However, it can

return success even when the requested SPI is already in use, leading

to duplicate SPIs assigned to multiple inbound SAs, differentiated

only by their destination addresses.

This behavior causes inconsistencies during SPI lookups for inbound packets.

Since the lookup may return an arbitrary SA among those with the same SPI,

packet processing can fail, resulting in packet drops.

According to RFC 4301 section 4.4.2 , for inbound processing a unicast SA

is uniquely identified by the SPI and optionally protocol.

Reproducing the Issue Reliably:

To consistently reproduce the problem, restrict the available SPI range

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References