--- id: "CVE-2025-39964" kind: "vulnerability" aliases: ["CVE-2025-39964"] title: "In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in\u2026" severity: "high" cvss: 7.8 epss: null exploited: true status: "open" category: "runtime" products: [{"name": "Linux Kernel", "fixed": ["5.10.245", "5.15.194", "6.1.154", "6.6.108", "6.12.49", "6.16.9", "6.17"], "affected": ">= 2.6.38, < 5.10.245; >= 5.11, < 5.15.194; >= 5.16, < 6.1.154; >= 6.2, < 6.6.108; >= 6.7, < 6.12.49; >= 6.13, < 6.16.9; 6.17-rc only", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.10.245"], "affected": ">= 2.6.38, < 5.10.245", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["5.15.194"], "affected": ">= 5.11, < 5.15.194", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.1.154"], "affected": ">= 5.16, < 6.1.154", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.6.108"], "affected": ">= 6.2, < 6.6.108", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.12.49"], "affected": ">= 6.7, < 6.12.49", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": ["6.16.9"], "affected": ">= 6.13, < 6.16.9", "ecosystem": "vendor"}, {"name": "linux kernel", "fixed": [], "affected": "= 6.17", "ecosystem": "vendor"}, {"name": "siemens simatic s7-1500 cpu 1518-4 pn\\/dp mfp firmware", "fixed": [], "affected": ">= 3.1.6", "ecosystem": "vendor"}, {"name": "siemens simatic s7-1500 cpu 1518f-4 pn\\/dp mfp firmware", "fixed": [], "affected": ">= 3.1.6", "ecosystem": "vendor"}, {"name": "Linux Kernel", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["af_alg", "exploited", "kernel", "linux", "local-privilege", "runtime", "self-hosted"] not_affected_if: ["kernel-6.17-or-later", "no-af-alg-usage", "patched-distro-kernel"] published_at: "2025-10-13T14:15:34+00:00" first_seen_at: "2026-10-23T19:11:50+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39964", "first_seen_at": "2026-10-23T19:11:50+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:37:05+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39964", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in… Race condition in the Linux kernel crypto API (crypto/af_alg.c, af_alg_sendmsg): two concurrent writes to one AF_ALG socket interleave data and corrupt the socket state. Local, low-privilege attacker (CVSS 7.8 per kernel CNA; NVD scores 5.5). Present since 2.6.38. CISA KEV lists it as exploited since 2026-09-18; no public PoC found. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Linux Kernel affected >= 2.6.38, < 5.10.245; >= 5.11, < 5.15.194; >= 5.16, < 6.1.154; >= 6.2, < 6.6.108; >= 6.7, < 6.12.49; >= 6.13, < 6.16.9; 6.17-rc only fixed 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, 6.17 - vendor:linux kernel affected >= 2.6.38, < 5.10.245 fixed 5.10.245 - vendor:linux kernel affected >= 5.11, < 5.15.194 fixed 5.15.194 - vendor:linux kernel affected >= 5.16, < 6.1.154 fixed 6.1.154 - vendor:linux kernel affected >= 6.2, < 6.6.108 fixed 6.6.108 - vendor:linux kernel affected >= 6.7, < 6.12.49 fixed 6.12.49 - vendor:linux kernel affected >= 6.13, < 6.16.9 fixed 6.16.9 - vendor:linux kernel affected = 6.17 fixed ? - vendor:siemens simatic s7-1500 cpu 1518-4 pn\/dp mfp firmware affected >= 3.1.6 fixed ? - vendor:siemens simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmware affected >= 3.1.6 fixed ? - vendor:Linux Kernel affected ? fixed ? ## How to check Run uname -r and compare with the fixed versions per branch. Distro kernels backport fixes, so check the distro tracker: Ubuntu 24.04 needs 6.8.0-90.91+, 22.04 needs 5.15.0-164.174+, Debian bookworm needs 6.1.190-1+, trixie needs 6.12.113-1+. If you can, check whether the algif modules are loaded (lsmod | grep algif) or built in (grep CONFIG_CRYPTO_USER_API /boot/config-$(uname -r)). ## Fix Update to a fixed kernel and reboot: 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, 6.17 or later, or your distro's patched kernel package. If you cannot patch, blacklisting the algif_* modules is a possible stopgap, but that is untested, so check that nothing on the host depends on AF_ALG first. Red Hat says no mitigation is available. ## Timeline - 2026-10-23T19:11:50+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39964 - 2026-10-23T21:37:05+00:00 analyst — Read kernel CNA announcement (fixed versions per stable branch), Ubuntu/Debian/RH pages. KEV-listed 2026-09-18; no public PoC or exploitation details found; X has ~1 post, no discussion worth saving. Reporters: STAR Labs. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-39964 ## Documents - [advisory] kernel CNA: CVE-2025-39964 af_alg concurrent writes https://lists.openwall.net/linux-cve-announce/2025/10/13/2 - [describes] Red Hat CVE-2025-39964 https://access.redhat.com/security/cve/cve-2025-39964 - [fix] Ubuntu CVE-2025-39964 https://ubuntu.com/security/CVE-2025-39964 - [fix] Debian tracker CVE-2025-39964 https://security-tracker.debian.org/tracker/CVE-2025-39964 ## From the sources Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_