Vulnerability-Lookup

GHSA-HVPG-7HJ3-VFP4

Vulnerability from github – Published: 2025-09-15 15:31 – Updated: 2025-11-24 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts

Restore the SIMD usability check that was removed by commit a59e5468a921 ("crypto: arm64/poly1305 - Add block-only interface").

This safety check is cheap and is well worth eliminating a footgun. While the Poly1305 functions should not be called when SIMD registers are unusable, if they are anyway, they should just do the right thing instead of corrupting random tasks' registers and/or computing incorrect MACs. Fixing this is also needed for poly1305_kunit to pass.

Just use may_use_simd() instead of the original crypto_simd_usable(), since poly1305_kunit won't rely on crypto_simd_disabled_for_test.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-39804"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-15T13:15:35Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts\n\nRestore the SIMD usability check that was removed by commit a59e5468a921\n(\"crypto: arm64/poly1305 - Add block-only interface\").\n\nThis safety check is cheap and is well worth eliminating a footgun.\nWhile the Poly1305 functions should not be called when SIMD registers\nare unusable, if they are anyway, they should just do the right thing\ninstead of corrupting random tasks\u0027 registers and/or computing incorrect\nMACs.  Fixing this is also needed for poly1305_kunit to pass.\n\nJust use may_use_simd() instead of the original crypto_simd_usable(),\nsince poly1305_kunit won\u0027t rely on crypto_simd_disabled_for_test.",
  "id": "GHSA-hvpg-7hj3-vfp4",
  "modified": "2025-11-24T18:31:08Z",
  "published": "2025-09-15T15:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39804"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/eec76ea5a7213c48529a46eed1b343e5cee3aaab"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ef74efa598b7bbc5c24509f7f56af2806f81c339"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-39804 (GCVE-0-2025-39804)

Vulnerability from cvelistv5 – Published: 2025-09-15 12:36 – Updated: 2026-08-05 12:05

Title

lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts

Summary

In the Linux kernel, the following vulnerability has been resolved: lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts Restore the SIMD usability check that was removed by commit a59e5468a921 ("crypto: arm64/poly1305 - Add block-only interface"). This safety check is cheap and is well worth eliminating a footgun. While the Poly1305 functions should not be called when SIMD registers are unusable, if they are anyway, they should just do the right thing instead of corrupting random tasks' registers and/or computing incorrect MACs. Fixing this is also needed for poly1305_kunit to pass. Just use may_use_simd() instead of the original crypto_simd_usable(), since poly1305_kunit won't rely on crypto_simd_disabled_for_test.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

2 references

URL	Tags
https://git.kernel.org/stable/c/ef74efa598b7bbc5c…
https://git.kernel.org/stable/c/eec76ea5a7213c485…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a59e5468a921937cb7317892779c67046ad9f5cc , < ef74efa598b7bbc5c24509f7f56af2806f81c339 (git) Affected: a59e5468a921937cb7317892779c67046ad9f5cc , < eec76ea5a7213c48529a46eed1b343e5cee3aaab (git)
Linux	Linux	Affected: 6.16 Unaffected: 0 , < 6.16 (semver) Unaffected: 6.16.4 , ≤ 6.16.* (semver) Unaffected: 6.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "lib/crypto/arm64/poly1305-glue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ef74efa598b7bbc5c24509f7f56af2806f81c339",
              "status": "affected",
              "version": "a59e5468a921937cb7317892779c67046ad9f5cc",
              "versionType": "git"
            },
            {
              "lessThan": "eec76ea5a7213c48529a46eed1b343e5cee3aaab",
              "status": "affected",
              "version": "a59e5468a921937cb7317892779c67046ad9f5cc",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "lib/crypto/arm64/poly1305-glue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.4",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts\n\nRestore the SIMD usability check that was removed by commit a59e5468a921\n(\"crypto: arm64/poly1305 - Add block-only interface\").\n\nThis safety check is cheap and is well worth eliminating a footgun.\nWhile the Poly1305 functions should not be called when SIMD registers\nare unusable, if they are anyway, they should just do the right thing\ninstead of corrupting random tasks\u0027 registers and/or computing incorrect\nMACs.  Fixing this is also needed for poly1305_kunit to pass.\n\nJust use may_use_simd() instead of the original crypto_simd_usable(),\nsince poly1305_kunit won\u0027t rely on crypto_simd_disabled_for_test."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Poly1305 is the MAC half of ChaCha20-Poly1305 and is driven directly by remote peer data in WireGuard, IPsec ESP (rfc7539esp) and kTLS on arm64 routers, phones and cloud servers, so an off-path attacker\u0027s packets are what cause the vulnerable `poly1305_blocks_arch()` invocation.\nAC:L - There is no race to win and no memory layout to groom; once the MAC computation runs in a context where SIMD is unusable the `BUG_ON(!may_use_simd())` in `kernel_neon_begin()` fires deterministically, and the attacker only has to send traffic that is MAC-verified.\nPR:N - For ChaCha20-Poly1305 AEAD the Poly1305 tag computation is itself the authentication step, so it processes an unauthenticated peer\u0027s packet before any credential is validated; no account or key on the target is needed.\nUI:N - Packet reception and the resulting AEAD tag verification happen automatically in the kernel with no action by any local user.\nS:U - The fault and its consequences are entirely within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:N - On arm64 the `BUG_ON` in `kernel_neon_begin()` traps before any NEON instruction executes, so the FPSIMD-register leak that the check guards against cannot be reached in the `have_neon` configuration and no memory is disclosed.\nI:N - The trap gives the attacker no write primitive, and a Poly1305 tag computed from a disturbed state fails closed on verification rather than allowing forged data to be accepted.\nA:H - Hitting `BUG_ON(!may_use_simd())` raises a kernel BUG from interrupt context, producing a fatal exception in interrupt / panic that takes down the whole system, and it can be re-triggered by simply resending traffic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:05:18.397Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ef74efa598b7bbc5c24509f7f56af2806f81c339"
        },
        {
          "url": "https://git.kernel.org/stable/c/eec76ea5a7213c48529a46eed1b343e5cee3aaab"
        }
      ],
      "title": "lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39804",
    "datePublished": "2025-09-15T12:36:46.483Z",
    "dateReserved": "2025-04-16T07:20:57.135Z",
    "dateUpdated": "2026-08-05T12:05:18.397Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted