Live › vulnerability › CVE-2025-39964
Go to dashboardRace condition in the Linux kernel crypto API (crypto/af_alg.c, af_alg_sendmsg): two concurrent writes to one AF_ALG socket interleave data and corrupt the socket state. Local, low-privilege attacker (CVSS 7.8 per kernel CNA; NVD scores 5.5). Present since 2.6.38. CISA KEV lists it as exploited since 2026-09-18; no public PoC found.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Linux Kernel | vendor | >= 2.6.38, < 5.10.245; >= 5.11, < 5.15.194; >= 5.16, < 6.1.154; >= 6.2, < 6.6.108; >= 6.7, < 6.12.49; >= 6.13, < 6.16.9; 6.17-rc only | 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, 6.17 |
| linux kernel | vendor | >= 2.6.38, < 5.10.245 | 5.10.245 |
| linux kernel | vendor | >= 5.11, < 5.15.194 | 5.15.194 |
| linux kernel |
| vendor |
| >= 5.16, < 6.1.154 |
| 6.1.154 |
| linux kernel | vendor | >= 6.2, < 6.6.108 | 6.6.108 |
| linux kernel | vendor | >= 6.7, < 6.12.49 | 6.12.49 |
| linux kernel | vendor | >= 6.13, < 6.16.9 | 6.16.9 |
| linux kernel | vendor | = 6.17 | – |
| siemens simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware | vendor | >= 3.1.6 | – |
| siemens simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware | vendor | >= 3.1.6 | – |
| Linux Kernel | vendor | – | – |
6.8.0-90.91+, 22.04 needs 5.15.0-164.174+, Debian bookworm needs 6.1.190-1+, trixie needs 6.12.113-1+5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, 6.17 or later, or your distro's patched kernel packageEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2025-39964")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.