CVE-2025-39804 (GCVE-0-2025-39804)

Vulnerability from cvelistv5 – Published: 2025-09-15 12:36 – Updated: 2026-08-05 12:05
VLAI
Title
lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts
Summary
In the Linux kernel, the following vulnerability has been resolved: lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts Restore the SIMD usability check that was removed by commit a59e5468a921 ("crypto: arm64/poly1305 - Add block-only interface"). This safety check is cheap and is well worth eliminating a footgun. While the Poly1305 functions should not be called when SIMD registers are unusable, if they are anyway, they should just do the right thing instead of corrupting random tasks' registers and/or computing incorrect MACs. Fixing this is also needed for poly1305_kunit to pass. Just use may_use_simd() instead of the original crypto_simd_usable(), since poly1305_kunit won't rely on crypto_simd_disabled_for_test.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6639 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a59e5468a921937cb7317892779c67046ad9f5cc , < ef74efa598b7bbc5c24509f7f56af2806f81c339 (git)
Affected: a59e5468a921937cb7317892779c67046ad9f5cc , < eec76ea5a7213c48529a46eed1b343e5cee3aaab (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.16.4 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "lib/crypto/arm64/poly1305-glue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef74efa598b7bbc5c24509f7f56af2806f81c339",
              "status": "affected",
              "version": "a59e5468a921937cb7317892779c67046ad9f5cc",
              "versionType": "git"
            },
            {
              "lessThan": "eec76ea5a7213c48529a46eed1b343e5cee3aaab",
              "status": "affected",
              "version": "a59e5468a921937cb7317892779c67046ad9f5cc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "lib/crypto/arm64/poly1305-glue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts\n\nRestore the SIMD usability check that was removed by commit a59e5468a921\n(\"crypto: arm64/poly1305 - Add block-only interface\").\n\nThis safety check is cheap and is well worth eliminating a footgun.\nWhile the Poly1305 functions should not be called when SIMD registers\nare unusable, if they are anyway, they should just do the right thing\ninstead of corrupting random tasks\u0027 registers and/or computing incorrect\nMACs.  Fixing this is also needed for poly1305_kunit to pass.\n\nJust use may_use_simd() instead of the original crypto_simd_usable(),\nsince poly1305_kunit won\u0027t rely on crypto_simd_disabled_for_test."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Poly1305 is the MAC half of ChaCha20-Poly1305 and is driven directly by remote peer data in WireGuard, IPsec ESP (rfc7539esp) and kTLS on arm64 routers, phones and cloud servers, so an off-path attacker\u0027s packets are what cause the vulnerable `poly1305_blocks_arch()` invocation.\nAC:L - There is no race to win and no memory layout to groom; once the MAC computation runs in a context where SIMD is unusable the `BUG_ON(!may_use_simd())` in `kernel_neon_begin()` fires deterministically, and the attacker only has to send traffic that is MAC-verified.\nPR:N - For ChaCha20-Poly1305 AEAD the Poly1305 tag computation is itself the authentication step, so it processes an unauthenticated peer\u0027s packet before any credential is validated; no account or key on the target is needed.\nUI:N - Packet reception and the resulting AEAD tag verification happen automatically in the kernel with no action by any local user.\nS:U - The fault and its consequences are entirely within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:N - On arm64 the `BUG_ON` in `kernel_neon_begin()` traps before any NEON instruction executes, so the FPSIMD-register leak that the check guards against cannot be reached in the `have_neon` configuration and no memory is disclosed.\nI:N - The trap gives the attacker no write primitive, and a Poly1305 tag computed from a disturbed state fails closed on verification rather than allowing forged data to be accepted.\nA:H - Hitting `BUG_ON(!may_use_simd())` raises a kernel BUG from interrupt context, producing a fatal exception in interrupt / panic that takes down the whole system, and it can be re-triggered by simply resending traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:18.397Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef74efa598b7bbc5c24509f7f56af2806f81c339"
        },
        {
          "url": "https://git.kernel.org/stable/c/eec76ea5a7213c48529a46eed1b343e5cee3aaab"
        }
      ],
      "title": "lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39804",
    "datePublished": "2025-09-15T12:36:46.483Z",
    "dateReserved": "2025-04-16T07:20:57.135Z",
    "dateUpdated": "2026-08-05T12:05:18.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39804",
      "date": "2026-11-09",
      "epss": "0.00252",
      "percentile": "0.16756"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "lib/crypto/arm64/poly1305-glue.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ef74efa598b7bbc5c24509f7f56af2806f81c339",
                    "status": "affected",
                    "version": "a59e5468a921937cb7317892779c67046ad9f5cc",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eec76ea5a7213c48529a46eed1b343e5cee3aaab",
                    "status": "affected",
                    "version": "a59e5468a921937cb7317892779c67046ad9f5cc",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "lib/crypto/arm64/poly1305-glue.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.16.*",
                    "status": "unaffected",
                    "version": "6.16.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.17",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26A22BE8-0D22-4155-AED4-BB823BB934AB",
                    "versionEndExcluding": "6.16.4",
                    "versionStartIncluding": "6.16",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts\n\nRestore the SIMD usability check that was removed by commit a59e5468a921\n(\"crypto: arm64/poly1305 - Add block-only interface\").\n\nThis safety check is cheap and is well worth eliminating a footgun.\nWhile the Poly1305 functions should not be called when SIMD registers\nare unusable, if they are anyway, they should just do the right thing\ninstead of corrupting random tasks\u0027 registers and/or computing incorrect\nMACs.  Fixing this is also needed for poly1305_kunit to pass.\n\nJust use may_use_simd() instead of the original crypto_simd_usable(),\nsince poly1305_kunit won\u0027t rely on crypto_simd_disabled_for_test."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nlib/crypto: arm64/poly1305: Correcci\u00f3n de la corrupci\u00f3n de registros en contextos sin SIMD\n\nRestaurar la verificaci\u00f3n de usabilidad de SIMD que fue eliminada por el commit a59e5468a921 (\u0027crypto: arm64/poly1305 - A\u00f1adir interfaz de solo bloque\u0027).\n\nEsta verificaci\u00f3n de seguridad es econ\u00f3mica y bien vale la pena eliminar un riesgo de auto-da\u00f1o. Aunque las funciones Poly1305 no deber\u00edan ser llamadas cuando los registros SIMD no son utilizables, si lo son de todos modos, deber\u00edan simplemente hacer lo correcto en lugar de corromper los registros de tareas aleatorias y/o calcular MACs incorrectos. Corregir esto tambi\u00e9n es necesario para que poly1305_kunit pase.\n\nSimplemente usar may_use_simd() en lugar de la original crypto_simd_usable(), ya que poly1305_kunit no depender\u00e1 de crypto_simd_disabled_for_test."
          }
        ],
        "id": "CVE-2025-39804",
        "lastModified": "2026-10-19T21:10:00.160",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-09-15T13:15:35.933",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/eec76ea5a7213c48529a46eed1b343e5cee3aaab"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ef74efa598b7bbc5c24509f7f56af2806f81c339"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-11-07T13:40:55+00:00",
      "cve": "CVE-2025-39804",
      "id": "CVE-2025-39804",
      "initial_release_date": "2025-09-15T00:00:00+00:00",
      "product_status:known_not_affected": "200",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-39804.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.