CVE-2025-39789

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The AEGIS-128 AEAD is driven from the local crypto API — an unprivileged user reaches it directly via an AF_ALG/algif_aead socket, and in-kernel consumers (dm-crypt, xfrm ESP) are configured locally. A remote peer cannot itself supply input that reaches the failing allocation, so this is local.

AC:LAttack complexity, low

The failure requires a memory allocation failure inside skcipher_walk, but the attacker can both force the allocating slow path on every walk step (by submitting scatterlists fragmented below the 16-byte chunksize) and induce the memory pressure, then retry the operation arbitrarily many times; the GFP_ATOMIC variant used by softirq consumers fails readily under attacker-generated load.

PR:LPrivileges required, low

Binding an AF_ALG socket to "aegis128" and issuing encrypt requests requires only an unprivileged local account — no capability, and module autoload happens on the user's behalf.

UI:NUser interaction, none

The attacker triggers the encrypt/decrypt path entirely on their own; no victim action is needed.

S:UScope, unchanged

The faulty error handling and its consequences stay within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

On the unchecked error path the encrypt call returns success without encrypting, so the "ciphertext" handed to the caller is the raw plaintext (in-place operations) or stale kernel buffer contents (out-of-place, e.g. dm-crypt/ESP buffers), disclosing data that was supposed to be protected to disk, network peers, or backups.

I:HIntegrity impact, high

The kernel reports a successful AEAD operation while producing unencrypted, partially encrypted, or stale output with a mismatched tag, so data written to encrypted storage or an encrypted tunnel is silently wrong and cannot be distinguished from valid output by the caller.

A:LAvailability impact, low

No kernel crash, hang, or corruption occurs; the impact is that the silently bad ciphertext/tag causes downstream rejection — dropped IPsec packets, I/O errors on integrity-protected volumes, and unrecoverable stored blocks — which is a limited interruption rather than a full loss of availability.