In the Linux kernel, the following vulnerability has been resolved:
xfrm: Duplicate SPI Handling
The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI Netlink message, which triggers the kernel function xfrm_alloc_spi(). This function is expected to ensure uniqueness of the Security Parameter Index (SPI) for inbound Security Associations (SAs). However, it can return success even when the requested SPI is already in use, leading to duplicate SPIs assigned to multiple inbound SAs, differentiated only by their destination addresses.
This behavior causes inconsistencies during SPI lookups for inbound packets. Since the lookup may return an arbitrary SA among those with the same SPI, packet processing can fail, resulting in packet drops.
According to RFC 4301 section 4.4.2 , for inbound processing a unicast SA is uniquely identified by the SPI and optionally protocol.
Reproducing the Issue Reliably: To consistently reproduce the problem, restrict the available SPI range in charon.conf : spi_min = 0x10000000 spi_max = 0x10000002 This limits the system to only 2 usable SPI values. Next, create more than 2 Child SA. each using unique pair of src/dst address. As soon as the 3rd Child SA is initiated, it will be assigned a duplicate SPI, since the SPI pool is already exhausted. With a narrow SPI range, the issue is consistently reproducible. With a broader/default range, it becomes rare and unpredictable.
Current implementation: xfrm_spi_hash() lookup function computes hash using daddr, proto, and family. So if two SAs have the same SPI but different destination addresses, then they will: a. Hash into different buckets b. Be stored in different linked lists (byspi + h) c. Not be seen in the same hlist_for_each_entry_rcu() iteration. As a result, the lookup will result in NULL and kernel allows that Duplicate SPI
Proposed Change: xfrm_state_lookup_spi_proto() does a truly global search - across all states, regardless of hash bucket and matches SPI and proto.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-rt-debug-develUpgrade kernel-rt-coreUpgrade kernel-modulesUpgrade kernel-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-debug-devel-matchedUpgrade perfUpgrade kernel-uki-virtUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-modules-extraUpgrade kernel-64k-coreUpgrade kernel-rt-debug-modules-coreUpgrade kernel-debug-develUpgrade kernel-debug-uki-virtUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-headersUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-64k-devel-matchedUpgrade kernel-docUpgrade kernel-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-64k-modules-coreUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade rtlaUpgrade kernel-64k-debug-modules-extraUpgrade kernel-64k-develUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-debug-modules-extraUpgrade libperfUpgrade kernel-tools-libs-develUpgrade kernel-cross-headersUpgrade kernel-rtUpgrade kernel-64k-debug-modulesUpgrade kernel-zfcpdump-coreUpgrade kernel-rt-debugUpgrade kernelUpgrade kernel-rt-64kUpgrade kernel-rt-64k-debug-develUpgrade kernel-rt-modules-coreUpgrade kernel-rt-64k-develUpgrade kernel-64k-debug-modules-coreUpgrade python3-perfUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debugUpgrade kernel-64k-modulesUpgrade kernel-64k-debug-coreUpgrade kernel-rt-64k-coreUpgrade kernel-rt-develUpgrade kernel-tools-libsUpgrade kernel-uki-virt-addonsUpgrade kernel-rt-modulesUpgrade rvUpgrade kernel-64k-debug-develUpgrade kernel-debug-modulesUpgrade kernel-rt-64k-debugUpgrade kernel-develUpgrade kernel-64kUpgrade kernel-rt-64k-debug-coreUpgrade kernel-rt-modules-extraUpgrade kernel-64k-debug-devel-matchedUpgrade kernel-rt-debug-coreUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-toolsUpgrade kernel-64k-modules-extra | Aug 2, 2026 | Jul 28, 2026 |
| Amazon_linux_2023 | — | Upgrade bpftool6.12Upgrade bpftool6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12-modules-extraUpgrade kernel6.12-libbpf-develUpgrade kernel6.12Upgrade kernel6.12-develUpgrade kernel-livepatch-6.12.46-66.121Upgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-modules-extra-commonUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-tools-develUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-toolsUpgrade perf6.12Upgrade kernel6.12-libbpfUpgrade kernel6.12-libbpf-staticUpgrade kernel6.12-headersUpgrade kernel6.12-debuginfo-common-x86_64Upgrade python3-perf6.12 | Oct 1, 2025 | Sep 12, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernelUpgrade kernel-toolsUpgrade kernel-abi-stablelists | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernelUpgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelists | Jan 15, 2026 | Jan 13, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-tools-libsUpgrade python3-perf | Feb 3, 2026 | Jan 13, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 16, 2025 | Sep 12, 2025 |
| Redhat_linux | — | Upgrade kernelNo solution existsUpgrade kernel-rt | Jul 17, 2026 | Sep 12, 2025 |
| Rocky_linux | — | Upgrade perfUpgrade kernel-uki-virtUpgrade kernel-rt-debug-modules-coreUpgrade kernel-toolsUpgrade kernel-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-zfcpdump-coreUpgrade libperf-debuginfoUpgrade libperfUpgrade kernel-rt-debug-develUpgrade python3-perfUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade rvUpgrade perf-debuginfoUpgrade kernel-devel-matchedUpgrade kernel-rtUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-develUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-debuginfoUpgrade kernel-modules-extraUpgrade kernelUpgrade kernel-modulesUpgrade kernel-debug-uki-virtUpgrade kernel-rt-modulesUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-debug-modules-coreUpgrade kernel-debug-debuginfoUpgrade kernel-rt-modules-coreUpgrade kernel-zfcpdumpUpgrade kernel-rt-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-develUpgrade kernel-rt-debug-debuginfoUpgrade kernel-coreUpgrade kernel-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-zfcpdump-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade rtlaUpgrade kernel-debuginfoUpgrade kernel-tools-libsUpgrade kernel-debugUpgrade kernel-develUpgrade kernel-rt-debugUpgrade kernel-debuginfo-common-x86_64Upgrade python3-perf-debuginfo | Aug 3, 2026 | Jul 30, 2026 |
| Suse | — | Upgrade reiserfs-kmp-64kbUpgrade dtb-broadcomUpgrade kernel-kvmsmallUpgrade dtb-amlogicUpgrade kernel-rtUpgrade kernel-azure-vdsoUpgrade kernel-azure-optionalUpgrade kernel-default-livepatchUpgrade dlm-kmp-defaultUpgrade kernel-debug-vdsoUpgrade kernel-64kb-extraUpgrade kernel-source-vanillaUpgrade dtb-socionextUpgrade dtb-sprdUpgrade kernel-devel-azureUpgrade kernel-rt_debugUpgrade kernel-azure-extraUpgrade dtb-nvidiaUpgrade kernel-macrosUpgrade dlm-kmp-64kbUpgrade kernel-source-rtUpgrade dtb-rockchipUpgrade kernel-rt_debug-vdsoUpgrade kernel-syms-rtUpgrade dtb-alteraUpgrade gfs2-kmp-defaultUpgrade kernel-obs-buildUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade dtb-lgUpgrade dtb-freescaleUpgrade kernel-azure-develUpgrade cluster-md-kmp-defaultUpgrade kernel-rt-extraUpgrade kernel-rt-optionalUpgrade kernel-syms-azureUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-rtUpgrade kernel-sourceUpgrade kernel-rt-vdsoUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-vdsoUpgrade dtb-qcomUpgrade kernel-defaultUpgrade dtb-marvellUpgrade kernel-azureUpgrade dtb-exynosUpgrade kernel-rt_debug-develUpgrade kselftests-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-rt-develUpgrade dtb-amdUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-azureUpgrade dtb-caviumUpgrade dlm-kmp-azureUpgrade kernel-debug-develUpgrade kernel-default-develUpgrade dtb-allwinnerUpgrade kernel-rt-livepatchUpgrade reiserfs-kmp-rtUpgrade dtb-amazonUpgrade ocfs2-kmp-defaultUpgrade dtb-renesasUpgrade kernel-default-livepatch-develUpgrade dtb-armUpgrade reiserfs-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-debugUpgrade kernel-default-optionalUpgrade kernel-64kb-develUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-symsUpgrade kernel-obs-qaUpgrade gfs2-kmp-rtUpgrade kernel-default-extraUpgrade dtb-mediatekUpgrade kernel-docsUpgrade kernel-default-baseUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-defaultUpgrade kernel-64kbUpgrade dtb-appleUpgrade dtb-apmUpgrade gfs2-kmp-azureUpgrade reiserfs-kmp-defaultUpgrade kernel-develUpgrade kselftests-kmp-64kbUpgrade kernel-source-azureUpgrade kernel-kvmsmall-develUpgrade kernel-default-vdsoUpgrade gfs2-kmp-64kbUpgrade dtb-xilinxUpgrade dtb-hisilicon | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-ibm-classicUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-nvidia-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-raspi-6.8Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-lowlatencyUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-azure-fipsUpgrade linux-image-realtime-6.8.1Upgrade linux-image-aws-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-aws-64k-6.8Upgrade linux-image-gkeopUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-gke-6.8Upgrade linux-image-virtual-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-oracle-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-raspiUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-azureUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-gke-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-genericUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-ibm-6.8Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-aws-64kUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-oem-22.04bUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-generic-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-kvmUpgrade linux-image-intel-iotgUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-azure-6.8Upgrade linux-image-fipsUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-gcpUpgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-oracleUpgrade linux-image-azure-fips-6.8Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-aws-fips-6.8Upgrade linux-image-awsUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-virtualUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-xilinxUpgrade linux-image-raspi-realtimeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-realtimeUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-fips-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidia-hwe-22.04 | Feb 12, 2026 | Sep 12, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Sep 12, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub