{"id":"CVE-2025-39931","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Set merge to zero early in af_alg_sendmsg\n\nIf an error causes af_alg_sendmsg to abort, ctx->merge may contain\na garbage value from the previous loop","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Set merge to zero early in af_alg_sendmsg\n\nIf an error causes af_alg_sendmsg to abort, ctx->merge may contain\na garbage value from the previous loop.  …","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-908"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 2.6.38, < 6.1.154","linux_kernel >= 6.2, < 6.6.108","linux_kernel >= 6.7, < 6.12.49","linux_kernel >= 6.13, < 6.16.9","linux_kernel = 6.17"],"patched":["linux_kernel 6.16.9"],"published":"2025-10-04","updated":"2026-07-04","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-39931","references":[{"url":"https://git.kernel.org/stable/c/045ee26aa3920a47ec46d7fcb302420bf01fd753","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/2374c11189ef704a3e4863646369f1b8e6a27d71","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/24c1106504c625fabd3b7229611af617b4c27ac7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/28f6f37abca7c5c9eb3959c66310f1d4d98b8aaf","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6241b9e2809b12da9130894cf5beddf088dc1b8a","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9574b2330dbd2b5459b74d3b5e9619d39299fc6f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/db2b42425dfbde4983b0c20fb7cfa05f70e6a745","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00161,"epssPercentile":0.04576,"ingestedAt":"2026-07-04T12:56:09.233Z","slug":"CVE-2025-39931","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Set merge to zero early in af_alg_sendmsg\n\nIf an error causes af_alg_sendmsg to abort, ctx->merge may contain\na garbage value from the previous loop.  This may then trigger a\ncrash on the next entry into af_alg_sendmsg when it attempts to do\na merge that can't be done.\n\nFix this by setting ctx->merge to zero near the start of the loop.\n\n## Affected\n\n- `linux_kernel >= 2.6.38, < 6.1.154`\n- `linux_kernel >= 6.2, < 6.6.108`\n- `linux_kernel >= 6.7, < 6.12.49`\n- `linux_kernel >= 6.13, < 6.16.9`\n- `linux_kernel = 6.17`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.16.9`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}