{"id":"CVE-2025-39964","kind":"vulnerability","aliases":["CVE-2025-39964"],"related":[],"title":"In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in…","description":"Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Race condition in the Linux kernel crypto API (crypto/af_alg.c, af_alg_sendmsg): two concurrent writes to one AF_ALG socket interleave data and corrupt the socket state. Local, low-privilege attacker (CVSS 7.8 per kernel CNA; NVD scores 5.5). Present since 2.6.38. CISA KEV lists it as exploited since 2026-09-18; no public PoC found.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2026-09-18T00:00:00+00:00","products":[{"name":"Linux Kernel","fixed":["5.10.245","5.15.194","6.1.154","6.6.108","6.12.49","6.16.9","6.17"],"affected":">= 2.6.38, < 5.10.245; >= 5.11, < 5.15.194; >= 5.16, < 6.1.154; >= 6.2, < 6.6.108; >= 6.7, < 6.12.49; >= 6.13, < 6.16.9; 6.17-rc only","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.10.245"],"affected":">= 2.6.38, < 5.10.245","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.15.194"],"affected":">= 5.11, < 5.15.194","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.1.154"],"affected":">= 5.16, < 6.1.154","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.6.108"],"affected":">= 6.2, < 6.6.108","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.12.49"],"affected":">= 6.7, < 6.12.49","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.16.9"],"affected":">= 6.13, < 6.16.9","ecosystem":"vendor"},{"name":"linux kernel","fixed":[],"affected":"= 6.17","ecosystem":"vendor"},{"name":"siemens simatic s7-1500 cpu 1518-4 pn\\/dp mfp firmware","fixed":[],"affected":">= 3.1.6","ecosystem":"vendor"},{"name":"siemens simatic s7-1500 cpu 1518f-4 pn\\/dp mfp firmware","fixed":[],"affected":">= 3.1.6","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["af_alg","exploited","kernel","linux","local-privilege","runtime","self-hosted"],"not_affected_if":["kernel-6.17-or-later","no-af-alg-usage","patched-distro-kernel"],"how_to_check":"Run uname -r and compare with the fixed versions per branch. Distro kernels backport fixes, so check the distro tracker: Ubuntu 24.04 needs 6.8.0-90.91+, 22.04 needs 5.15.0-164.174+, Debian bookworm needs 6.1.190-1+, trixie needs 6.12.113-1+. If you can, check whether the algif modules are loaded (lsmod | grep algif) or built in (grep CONFIG_CRYPTO_USER_API /boot/config-$(uname -r)).","fix":"Update to a fixed kernel and reboot: 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, 6.17 or later, or your distro's patched kernel package. If you cannot patch, blacklisting the algif_* modules is a possible stopgap, but that is untested, so check that nothing on the host depends on AF_ALG first. Red Hat says no mitigation is available.","status":"open","published_at":"2025-10-13T14:15:34+00:00","first_seen_at":"2026-10-23T19:11:50+00:00","triaged_at":"2026-10-23T20:31:29+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T20:31:29Z","model":"claude-haiku-5-5","output":{"fix":"Apply the kernel fix from your distribution or Linux kernel stable branch that addresses CVE-2025-39964; the sources do not name the fixed version.\nFollow CISA BOD 26-04 mitigation guidance for the affected asset.","summary":"A race condition in the Linux kernel's AF_ALG socket lets concurrent writes to the same socket interleave unpredictably and corrupt its internal state. CISA lists it as actively exploited, so an attacker with local access can reach kernel-level effects.","category":"runtime","who_cares":["linux","self-hosted","kernel"],"confidence":0.6,"analyst_note":"Sources give no affected or fixed kernel versions and no detection method; check the kernel.org CVE entry and the distro advisory for the fixed version and whether AF_ALG is exposed to unprivileged users.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-af-alg-usage"],"severity_if_unknown":"high"},"cost_usd":0.000393,"input_tokens":2203,"output_tokens":345,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Sources give no affected or fixed kernel versions and no detection method; check the kernel.org CVE entry and the distro advisory for the fixed version and whether AF_ALG is exposed to unprivileged users.","search":"'-04':181C,207C,238C '-09':126B '-1500':42A,53A '-18':127B '-2025':18A,21A '-39964':19A,22A '-4':45A,56A '/dp':47A,58A '1518':44A '1518f':55A '2.6.38':117B '2026':125B '26':180C,206C,237C '5.5':114B '7.8':108B 'accord':170C 'action':166C 'adher':234C 'af':12A,63B,84B,92B,146C 'alg':13A,64B,85B,93B,147C 'allow':140C 'api':82B 'appli':167C 'applic':204C 'asset':228C 'attack':106B 'base':185C 'bod':179C,205C,236C 'caus':149C 'cisa':118B,164C,177C,194C 'cloud':210C 'cna':111B 'complianc':175C 'concurr':15A,88B,141C 'condit':76B,137C 'contain':134C 'corrupt':98B 'cpu':43A,54A 'creat':156C 'crypto':11A,81B 'crypto/af_alg.c':83B 'cve':17A,20A 'cvss':107B 'data':96B,150C 'disallow':14A 'discontinu':213C 'ensur':174C,233C 'evalu':226C 'exploit':65B,123B 'exposur':231C 'firmware':49A,60A 'follow':6A,203C 'forens':196C 'found':131B 'guidanc':192C,208C 'guidelin':240C 'host':74B 'inconsist':157C 'instruct':173C 'interleav':95B,154C 'intern':162C 'internet':230C 'kernel':4A,24A,26A,28A,30A,32A,34A,36A,38A,62A,66B,80B,110B,133C 'kev':119B 'linux':3A,23A,25A,27A,29A,31A,33A,35A,37A,61A,67B,79B,132C 'list':120B 'local':69B,102B 'local-privileg':68B 'low':104B 'low-privileg':103B 'mfp':48A,59A 'mitig':168C,219C 'note':191C,202C 'nvd':112B 'one':91B 'patch':239C 'per':109B 'pn':46A,57A 'poc':130B 'present':115B 'priorit':182C 'privileg':70B,105B 'product':217C 'public':129B 'race':75B,136C 'requir':165C,198C 'resolv':10A 'respons':224C 'risk':187C 'runtim':71B 's7':41A,52A 'score':113B 'secur':183C 'see':188C,199C 'self':73B 'self-host':72B 'sendmsg':86B 'servic':211C 'siemens':39A,50A 'simatic':40A,51A 'sinc':116B,124B 'socket':94B,100B,148C,160C 'stakehold':222C 'state':101B,163C 'triag':197C 'two':87B 'unavail':221C 'unpredict':153C 'updat':184C 'url':189C,200C 'use':214C 'vendor':172C 'vulner':7A,138C 'write':16A,89B,142C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-10-13T14:15:34+00:00","kev":{"dateAdded":"2026-09-18","dueDate":"2026-09-21","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-39964","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39964","severity":null,"published_at":"2026-09-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:50+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-39964:114","url":null,"severity":null,"published_at":"2026-10-23T21:37:05+00:00","modified_at":"2026-10-23T21:37:05+00:00","first_seen_at":"2026-10-23T21:37:05+00:00","fetched_at":"2026-10-23T21:37:05+00:00","note":"Read kernel CNA announcement (fixed versions per stable branch), Ubuntu/Debian/RH pages. KEV-listed 2026-09-18; no public PoC or exploitation details found; X has ~1 post, no discussion worth saving. Reporters: STAR Labs."},{"source":"nvd","external_id":"CVE-2025-39964","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39964","severity":null,"published_at":"2025-10-13T14:15:34+00:00","modified_at":"2026-10-19T21:10:00+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1133,"url":"https://lists.openwall.net/linux-cve-announce/2025/10/13/2","title":"kernel CNA: CVE-2025-39964 af_alg concurrent writes","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1135,"url":"https://ubuntu.com/security/CVE-2025-39964","title":"Ubuntu CVE-2025-39964","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1137,"url":"https://security-tracker.debian.org/tracker/CVE-2025-39964","title":"Debian tracker CVE-2025-39964","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1139,"url":"https://access.redhat.com/security/cve/cve-2025-39964","title":"Red Hat CVE-2025-39964","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}