High 7.8Published Oct 4, 2025

CVE-2025-39931crypto: af_alg - Set merge to zero early in af_alg_sendmsg

Updated under an hour ago (Oct 28, 2026, 4:00 AM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Set merge to zero early in af_alg_sendmsg If an error causes af_alg_sendmsg to abort, ctx->merge may contain a garbage value from the previous loop. This may then trigger a crash on the next entry into af_alg_sendmsg when it attempts to do a merge that can't be done. Fix this by setting ctx->merge to zero near the start of the loop.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 before 28f6f37abca7c5c9eb3959c66310f1d4d98b8aaf; from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 before db2b42425dfbde4983b0c20fb7cfa05f70e6a745; from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 before 6241b9e2809b12da9130894cf5beddf088dc1b8a; from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 before 2374c11189ef704a3e4863646369f1b8e6a27d71; from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 before 24c1106504c625fabd3b7229611af617b4c27ac7; from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 before 045ee26aa3920a47ec46d7fcb302420bf01fd753; from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 before 9574b2330dbd2b5459b74d3b5e9619d39299fc6f	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.5	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.38 before 6.1.154; from 6.2 before 6.6.108; from 6.7 before 6.12.49; from 6.13 before 6.16.9; 6.17; 6.17; 6.17; 6.17; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/28f6f37abca7c5c9eb3959c66310f1d4d98b8aaf
https://git.kernel.org/stable/c/db2b42425dfbde4983b0c20fb7cfa05f70e6a745
https://git.kernel.org/stable/c/6241b9e2809b12da9130894cf5beddf088dc1b8a	patch
https://git.kernel.org/stable/c/2374c11189ef704a3e4863646369f1b8e6a27d71	patch
https://git.kernel.org/stable/c/24c1106504c625fabd3b7229611af617b4c27ac7	patch
https://git.kernel.org/stable/c/045ee26aa3920a47ec46d7fcb302420bf01fd753	patch
https://git.kernel.org/stable/c/9574b2330dbd2b5459b74d3b5e9619d39299fc6f	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.