01 Record

CVE-2025-39931

crypto: af_alg - Set merge to zero early in af_alg_sendmsg

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

crypto: af_alg - Set merge to zero early in af_alg_sendmsg

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.16% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 5.9% of scored records. A rank, not a probability.

NVD base score

5.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-10-04 07:30Z1 YR AGO

Last updated

2026-10-15 22:02Z14 DAYS AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-908Use of Uninitialized ResourceBase

Data version

5.2

Document digest

86a666c78798b0783b42bbc16f3c16cd4fd523202c61786f298867ba225d3daf

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to < 28f6f37abca7c5c9eb3959c66310f1d4d98b8aaf, 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to < db2b42425dfbde4983b0c20fb7cfa05f70e6a745, 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to < 6241b9e2809b12da9130894cf5beddf088dc1b8a, 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to < 2374c11189ef704a3e4863646369f1b8e6a27d71, 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to < 24c1106504c625fabd3b7229611af617b4c27ac7, 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to < 045ee26aa3920a47ec46d7fcb302420bf01fd753, 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to < 9574b2330dbd2b5459b74d3b5e9619d39299fc6f, 2.6.38—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/28f6f37abca7c5c9eb3959c66310f1d4d98b8aaf
git.kernel.orghttps://git.kernel.org/stable/c/db2b42425dfbde4983b0c20fb7cfa05f70e6a745
git.kernel.orghttps://git.kernel.org/stable/c/6241b9e2809b12da9130894cf5beddf088dc1b8a
git.kernel.orghttps://git.kernel.org/stable/c/2374c11189ef704a3e4863646369f1b8e6a27d71
git.kernel.orghttps://git.kernel.org/stable/c/24c1106504c625fabd3b7229611af617b4c27ac7
git.kernel.orghttps://git.kernel.org/stable/c/045ee26aa3920a47ec46d7fcb302420bf01fd753
git.kernel.orghttps://git.kernel.org/stable/c/9574b2330dbd2b5459b74d3b5e9619d39299fc6f
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-019113.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-457936.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.158-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.57-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.16.9-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.