CVE-2025-39802

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-39802", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.134Z", "datePublished": "2025-09-15T12:36:44.792Z", "dateUpdated": "2026-08-05T12:05:17.325Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:17.325Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts\n\nRestore the SIMD usability check that was removed by commit 773426f4771b\n(\"crypto: arm/poly1305 - Add block-only interface\").\n\nThis safety check is cheap and is well worth eliminating a footgun.\nWhile the Poly1305 functions should not be called when SIMD registers\nare unusable, if they are anyway, they should just do the right thing\ninstead of corrupting random tasks' registers and/or computing incorrect\nMACs. Fixing this is also needed for poly1305_kunit to pass.\n\nJust use may_use_simd() instead of the original crypto_simd_usable(),\nsince poly1305_kunit won't rely on crypto_simd_disabled_for_test."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - Poly1305 is the MAC half of ChaCha20-Poly1305 and is driven directly by remote peer data through WireGuard, IPsec ESP (rfc7539esp) and kTLS on 32-bit ARM routers, IoT gateways and automotive units, so an off-path attacker's packets are what cause the vulnerable `poly1305_blocks_arch()` invocation. No local access to the target is required.\nAC:L - There is no race to win and no memory layout to groom; once the MAC computation runs in a context where SIMD is unusable, the `BUG_ON(in_hardirq())`/`BUG_ON(irqs_disabled())` in ARM's `kernel_neon_begin()` fires deterministically, and the attacker only has to keep sending traffic that gets MAC-verified.\nPR:N - For ChaCha20-Poly1305 AEAD the Poly1305 tag computation *is* the authentication step, so it processes an unauthenticated peer's packet before any credential is validated (e.g. WireGuard handshake-initiation and cookie messages accepted from any source address); no account or key on the target is needed.\nUI:N - Packet reception and the resulting AEAD tag verification happen automatically inside the kernel with no action by any local user or administrator.\nS:U - The fault and its consequences are entirely within the kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:N - On ARM the `BUG_ON` pair in `kernel_neon_begin()` traps before any NEON instruction executes, so the VFP/NEON register leak the check guards against is not reached in the `have_neon` configuration and no kernel memory is disclosed.\nI:N - The trap gives the attacker no write primitive, and a Poly1305 tag computed from a disturbed state fails closed on verification rather than allowing forged data to be accepted.\nA:H - Hitting `BUG_ON(in_hardirq())`/`BUG_ON(irqs_disabled())` raises a kernel BUG from interrupt or IRQ-disabled context, producing a fatal exception in interrupt / panic that takes down the whole system, and it can be re-triggered simply by resending traffic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["lib/crypto/arm/poly1305-glue.c"], "versions": [{"version": "773426f4771bdd82ac5c834bf4c1775315c73a46", "lessThan": "87bdfba903be7084cb3ee04032b14a81181fe413", "status": "affected", "versionType": "git"}, {"version": "773426f4771bdd82ac5c834bf4c1775315c73a46", "lessThan": "52c3e242f4d0043186b70d65460ba1767f27494a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["lib/crypto/arm/poly1305-glue.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.16.4", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.16.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/87bdfba903be7084cb3ee04032b14a81181fe413"}, {"url": "https://git.kernel.org/stable/c/52c3e242f4d0043186b70d65460ba1767f27494a"}], "title": "lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["lib/crypto/arm/poly1305-glue.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "87bdfba903be7084cb3ee04032b14a81181fe413", "status": "affected", "version": "773426f4771bdd82ac5c834bf4c1775315c73a46", "versionType": "git"}, {"lessThan": "52c3e242f4d0043186b70d65460ba1767f27494a", "status": "affected", "version": "773426f4771bdd82ac5c834bf4c1775315c73a46", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["lib/crypto/arm/poly1305-glue.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.16.*", "status": "unaffected", "version": "6.16.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "26A22BE8-0D22-4155-AED4-BB823BB934AB", "versionEndExcluding": "6.16.4", "versionStartIncluding": "6.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts\n\nRestore the SIMD usability check that was removed by commit 773426f4771b\n(\"crypto: arm/poly1305 - Add block-only interface\").\n\nThis safety check is cheap and is well worth eliminating a footgun.\nWhile the Poly1305 functions should not be called when SIMD registers\nare unusable, if they are anyway, they should just do the right thing\ninstead of corrupting random tasks' registers and/or computing incorrect\nMACs. Fixing this is also needed for poly1305_kunit to pass.\n\nJust use may_use_simd() instead of the original crypto_simd_usable(),\nsince poly1305_kunit won't rely on crypto_simd_disabled_for_test."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nlib/crypto: arm/poly1305: Correcci\u00f3n de la corrupci\u00f3n de registros en contextos sin SIMD\n\nRestaurar la comprobaci\u00f3n de usabilidad de SIMD que fue eliminada por el commit 773426f4771b ('crypto: arm/poly1305 - A\u00f1adir interfaz solo de bloque').\n\nEsta comprobaci\u00f3n de seguridad es econ\u00f3mica y bien vale la pena eliminar un riesgo de error autoinfligido. Si bien las funciones Poly1305 no deber\u00edan ser llamadas cuando los registros SIMD no son utilizables, si lo son de todos modos, deber\u00edan simplemente hacer lo correcto en lugar de corromper los registros de tareas aleatorias y/o calcular MACs incorrectos. Corregir esto tambi\u00e9n es necesario para que poly1305_kunit pase.\n\nSimplemente usar may_use_simd() en lugar del original crypto_simd_usable(), ya que poly1305_kunit no depender\u00e1 de crypto_simd_disabled_for_test."}], "id": "CVE-2025-39802", "lastModified": "2026-10-19T21:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-09-15T13:15:35.703", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/52c3e242f4d0043186b70d65460ba1767f27494a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/87bdfba903be7084cb3ee04032b14a81181fe413"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts", "id": "2395202", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2395202"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2025-39802", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-09-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-39802\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-39802\nhttps://lore.kernel.org/linux-cve-announce/2025091551-CVE-2025-39802-fba9@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-09-17T10:08:11.998101+00:00", "updated": "2025-09-17T10:08:11.998153+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}