{"id":"CVE-2025-39931","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Set merge to zero early in af_alg_sendmsg\n\nIf an error causes af_alg_sendmsg to abort, ctx->merge may contain\na garbage value from the previous loop","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Set merge to zero early in af_alg_sendmsg\n\nIf an error causes af_alg_sendmsg to abort, ctx->merge may contain\na garbage value from the previous loop.  …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-908"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.38, < 6.1.154","linux_kernel >= 6.2, < 6.6.108","linux_kernel >= 6.7, < 6.12.49","linux_kernel >= 6.13, < 6.16.9","linux_kernel = 6.17"],"patched":["linux_kernel 6.16.9"],"published":"2025-10-04","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:18:02.900","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-39931","references":[{"url":"https://git.kernel.org/stable/c/045ee26aa3920a47ec46d7fcb302420bf01fd753","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2374c11189ef704a3e4863646369f1b8e6a27d71","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24c1106504c625fabd3b7229611af617b4c27ac7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/28f6f37abca7c5c9eb3959c66310f1d4d98b8aaf","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6241b9e2809b12da9130894cf5beddf088dc1b8a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9574b2330dbd2b5459b74d3b5e9619d39299fc6f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db2b42425dfbde4983b0c20fb7cfa05f70e6a745","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00169,"epssPercentile":0.06293,"ingestedAt":"2026-07-04T12:56:09.233Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-15T21:54:45.882341Z"},"slug":"CVE-2025-39931","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Set merge to zero early in af_alg_sendmsg\n\nIf an error causes af_alg_sendmsg to abort, ctx->merge may contain\na garbage value from the previous loop.  This may then trigger a\ncrash on the next entry into af_alg_sendmsg when it attempts to do\na merge that can't be done.\n\nFix this by setting ctx->merge to zero near the start of the loop.\n\n## Affected\n\n- `linux_kernel >= 2.6.38, < 6.1.154`\n- `linux_kernel >= 6.2, < 6.6.108`\n- `linux_kernel >= 6.7, < 6.12.49`\n- `linux_kernel >= 6.13, < 6.16.9`\n- `linux_kernel = 6.17`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.16.9`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":221561,"id":"CVE-2025-39931","ts":1792035262464,"field":"cvss","old":"5.5","new":"7.8"},{"seq":221560,"id":"CVE-2025-39931","ts":1792035262464,"field":"severity","old":"medium","new":"high"}]}