CVE-2025-39931

crypto: af_alg - Set merge to zero early in af_alg_sendmsg

State: Published
Severity: 7.8 High
Published: Oct 4, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: af_alg - Set merge to zero early in af_alg_sendmsg

If an error causes af_alg_sendmsg to abort, ctx->merge may contain a garbage value from the previous loop. This may then trigger a crash on the next entry into af_alg_sendmsg when it attempts to do a merge that can't be done.

Fix this by setting ctx->merge to zero near the start of the loop.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 28f6f37abca7c5c9eb3959c66310f1d4d98b8aafAffected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before db2b42425dfbde4983b0c20fb7cfa05f70e6a745Affected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 6241b9e2809b12da9130894cf5beddf088dc1b8aAffected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 2374c11189ef704a3e4863646369f1b8e6a27d71Affected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 24c1106504c625fabd3b7229611af617b4c27ac7Affected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 045ee26aa3920a47ec46d7fcb302420bf01fd753Affected 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 9574b2330dbd2b5459b74d3b5e9619d39299fc6fAffected
LinuxLinux	2.6.38Affected before 2.6.38Not affected 5.10.260 through 5.10.Not affected 5.15.211 through 5.15.Not affected 6.1.154 through 6.1.Not affected 6.6.108 through 6.6.Not affected 6.12.49 through 6.12.Not affected 6.16.9 through 6.16.Not affected 6.17 and laterNot affected

Product

Versions

LinuxLinux

8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 28f6f37abca7c5c9eb3959c66310f1d4d98b8aafAffected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before db2b42425dfbde4983b0c20fb7cfa05f70e6a745Affected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 6241b9e2809b12da9130894cf5beddf088dc1b8aAffected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 2374c11189ef704a3e4863646369f1b8e6a27d71Affected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 24c1106504c625fabd3b7229611af617b4c27ac7Affected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 045ee26aa3920a47ec46d7fcb302420bf01fd753Affected
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 to before 9574b2330dbd2b5459b74d3b5e9619d39299fc6fAffected

LinuxLinux

2.6.38Affected
before 2.6.38Not affected
5.10.260 through 5.10.*Not affected
5.15.211 through 5.15.*Not affected
6.1.154 through 6.1.*Not affected
6.6.108 through 6.6.*Not affected
6.12.49 through 6.12.*Not affected
6.16.9 through 6.16.*Not affected
6.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.