CVE-2025-39789

What it actually does

Missing error checks after skcipher_walk calls that allocate memory allow use of uninitialized or invalid state in the x86 AEGIS crypto implementation, leading to potential NULL dereference, kernel panic, or undefined behavior on allocation failure.

Why it matters to the business

Systems performing cryptographic operations with AEGIS on x86 may experience unexpected crashes or denial of service during memory pressure, increasing operational downtime and requiring kernel updates across affected Linux deployments.

How an attack unfolds

An attacker triggers memory exhaustion or allocation failure during AEGIS skcipher operations, causing the unchecked return value to be used and resulting in a kernel crash; no public exploitation or named threat actors have been observed.

How to fix it

Update the Linux kernel to a version containing commit 475104178f4d30e749ee4f5473c87f692b93bebb or later; rebuild and deploy the fixed kernel across all affected systems.

How to confirm the fix worked

Confirm the running kernel includes commit 475104178f4d30e749ee4f5473c87f692b93bebb via git log or kernel version string; test AEGIS crypto paths under simulated memory pressure to verify error paths are now handled.

Typical attack path

1. Identify a target system using AEGIS-based encryption on x86 Linux
2. Induce memory pressure to force skcipher_walk allocation failure
3. Initiate cryptographic operation that invokes the vulnerable path
4. Trigger kernel panic or denial of service from unchecked error

How to detect it

Review kernel logs for oops or panic messages originating from the AEGIS crypto module under memory pressure; no specific post-exploitation artifacts are known.

What your security team should do

• Prioritize kernel upgrade to the fixed commit on all production x86 systems using AEGIS
• Monitor for allocation-related kernel oops in crypto subsystems
• Review crypto configuration to determine AEGIS usage and exposure