CVE Details

CVE-2025-39964 Linux Kernel Race Condition Vulnerability
Published: 2026-09-18 CVSS: 7.8 HIGH Product: Linux Kernel Due Date: 2026-09-21

Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.

GitHub PoC

Warning: GitHub PoC repositories are unverified. Some may be fake or contain malware. Use caution and review code before running anything.

FIRST EPSS

EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.

Timeline

CVE Stalker KEV MITRE GitHub FIRST (EPSS)

MITRE

CVSS

  • Score: 7.8
  • Severity: HIGH
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

  • Exploitation: active
  • Automatable: no
  • Technical Impact: total

References

Show Raw Data
Key Remaining Key Value
dataType CVE_RECORD
dataVersion 5.2
cveMetadata > cveId CVE-2025-39964
cveMetadata > assignerOrgId 416baaa9-dc9f-4396-8d5f-8c081fb06d67
cveMetadata > state PUBLISHED
cveMetadata > assignerShortName Linux
cveMetadata > dateReserved 2025-04-16T07:20:57.149Z
cveMetadata > datePublished 2025-10-13T13:48:30.334Z
cveMetadata > dateUpdated 2026-09-18T14:41:56.523Z
containers > cna > providerMetadata > orgId 416baaa9-dc9f-4396-8d5f-8c081fb06d67
containers > cna > providerMetadata > shortName Linux
containers > cna > providerMetadata > dateUpdated 2026-08-05T12:06:33.126Z
containers > cna > descriptions > 0 > lang en
containers > cna > descriptions > 0 > value In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.
containers > cna > metrics > 0 > cvssV3_1 > version 3.1
containers > cna > metrics > 0 > cvssV3_1 > vectorString CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
containers > cna > metrics > 0 > cvssV3_1 > baseScore 7.8
containers > cna > metrics > 0 > cvssV3_1 > baseSeverity HIGH
containers > cna > metrics > 0 > scenarios > 0 > lang en
containers > cna > metrics > 0 > scenarios > 0 > value AV:L - The vulnerability is reached through the AF_ALG socket family via `socket()`/`bind()`/`sendmsg()`/`recvmsg()` syscalls, which requires local system access. There is no remote or adjacent-network path to `af_alg_sendmsg()`. AC:L - The attacker controls both sides of the race entirely — two of its own threads on a socket it owns — and can force writer A to park deterministically in `af_alg_wait_for_wmem()` by sizing `SO_SNDBUF` and filling it, then wake it on demand with its own `recvmsg()`. The error exit that leaves `cur == 0` is triggered at will with a deliberately faulting user buffer, so no condition is outside the attacker's control. PR:L - `alg_create()`, `alg_bind()` and `alg_setkey()` perform no capability checks whatsoever, so any unprivileged local user — including one inside a container or unprivileged user namespace — can open, bind and write to an AF_ALG skcipher/aead socket. The required modules are auto-loaded on demand via `MODULE_ALIAS_NETPROTO(AF_ALG)` and `request_module("algif-%s")`. UI:N - The attacking process performs every step itself — socket creation, bind, and the two concurrent `sendmsg()` calls. No victim action or interaction of any kind is needed. S:U - The corruption is confined to kernel heap objects (`struct af_alg_tsgl`/scatterlist and adjacent slab memory) within the same security authority. No hypervisor, IOMMU, or other trust boundary is crossed. C:H - The out-of-bounds scatterlist entry is fabricated from kernel list pointers and is subsequently handed to the cipher by `skcipher_recvmsg`/`aead_recvmsg` via `af_alg_pull_tsgl()`, so arbitrary kernel memory is encrypted/decrypted and returned to userspace. This yields a kernel memory disclosure primitive, not merely a pointer leak. I:H - `memcpy_from_msg(page_address(sg_page(sg)) + sg->offset + sg->length, msg, len)` on the underflowed scatterlist writes attacker-controlled data of attacker-chosen length to an address derived from attacker-influenceable heap contents. Combined with heap grooming of the 4KB tsgl allocations, this is a controlled kernel write suitable for privilege escalation. A:H - Dereferencing `page_address(sg_page(sg))` on a bogus page_link, and the later `put_page()` on that fabricated page, reliably produce an oops/panic or page refcount corruption. Any unprivileged user can trigger this repeatedly, crashing the machine.
containers > cna > affected > 0 > product Linux
containers > cna > affected > 0 > vendor Linux
containers > cna > affected > 0 > defaultStatus unaffected
containers > cna > affected > 0 > repo https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
containers > cna > affected > 0 > programFiles > 0 crypto/af_alg.c
containers > cna > affected > 0 > programFiles > 1 include/crypto/if_alg.h
containers > cna > affected > 0 > versions > 0 > version 8ff590903d5fc7f5a0a988c38267a3d08e6393a2
containers > cna > affected > 0 > versions > 0 > lessThan 0f28c4adbc4a97437874c9b669fd7958a8c6d6ce
containers > cna > affected > 0 > versions > 0 > status affected
containers > cna > affected > 0 > versions > 0 > versionType git
containers > cna > affected > 0 > versions > 1 > version 8ff590903d5fc7f5a0a988c38267a3d08e6393a2
containers > cna > affected > 0 > versions > 1 > lessThan e4c1ec11132ec466f7362a95f36a506ce4dc08c9
containers > cna > affected > 0 > versions > 1 > status affected
containers > cna > affected > 0 > versions > 1 > versionType git
containers > cna > affected > 0 > versions > 2 > version 8ff590903d5fc7f5a0a988c38267a3d08e6393a2
containers > cna > affected > 0 > versions > 2 > lessThan 1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8
containers > cna > affected > 0 > versions > 2 > status affected
containers > cna > affected > 0 > versions > 2 > versionType git
containers > cna > affected > 0 > versions > 3 > version 8ff590903d5fc7f5a0a988c38267a3d08e6393a2
containers > cna > affected > 0 > versions > 3 > lessThan 7c4491b5644e3a3708f3dbd7591be0a570135b84
containers > cna > affected > 0 > versions > 3 > status affected
containers > cna > affected > 0 > versions > 3 > versionType git
containers > cna > affected > 0 > versions > 4 > version 8ff590903d5fc7f5a0a988c38267a3d08e6393a2
containers > cna > affected > 0 > versions > 4 > lessThan 9aee87da5572b3a14075f501752e209801160d3d
containers > cna > affected > 0 > versions > 4 > status affected
containers > cna > affected > 0 > versions > 4 > versionType git
containers > cna > affected > 0 > versions > 5 > version 8ff590903d5fc7f5a0a988c38267a3d08e6393a2
containers > cna > affected > 0 > versions > 5 > lessThan 45bcf60fe49b37daab1acee57b27211ad1574042
containers > cna > affected > 0 > versions > 5 > status affected
containers > cna > affected > 0 > versions > 5 > versionType git
containers > cna > affected > 0 > versions > 6 > version 8ff590903d5fc7f5a0a988c38267a3d08e6393a2
containers > cna > affected > 0 > versions > 6 > lessThan 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285
containers > cna > affected > 0 > versions > 6 > status affected
containers > cna > affected > 0 > versions > 6 > versionType git
containers > cna > affected > 1 > product Linux
containers > cna > affected > 1 > vendor Linux
containers > cna > affected > 1 > defaultStatus affected
containers > cna > affected > 1 > repo https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
containers > cna > affected > 1 > programFiles > 0 crypto/af_alg.c
containers > cna > affected > 1 > programFiles > 1 include/crypto/if_alg.h
containers > cna > affected > 1 > versions > 0 > version 2.6.38
containers > cna > affected > 1 > versions > 0 > status affected
containers > cna > affected > 1 > versions > 1 > version 0
containers > cna > affected > 1 > versions > 1 > lessThan 2.6.38
containers > cna > affected > 1 > versions > 1 > status unaffected
containers > cna > affected > 1 > versions > 1 > versionType semver
containers > cna > affected > 1 > versions > 2 > version 5.10.245
containers > cna > affected > 1 > versions > 2 > lessThanOrEqual 5.10.*
containers > cna > affected > 1 > versions > 2 > status unaffected
containers > cna > affected > 1 > versions > 2 > versionType semver
containers > cna > affected > 1 > versions > 3 > version 5.15.194
containers > cna > affected > 1 > versions > 3 > lessThanOrEqual 5.15.*
containers > cna > affected > 1 > versions > 3 > status unaffected
containers > cna > affected > 1 > versions > 3 > versionType semver
containers > cna > affected > 1 > versions > 4 > version 6.1.154
containers > cna > affected > 1 > versions > 4 > lessThanOrEqual 6.1.*
containers > cna > affected > 1 > versions > 4 > status unaffected
containers > cna > affected > 1 > versions > 4 > versionType semver
containers > cna > affected > 1 > versions > 5 > version 6.6.108
containers > cna > affected > 1 > versions > 5 > lessThanOrEqual 6.6.*
containers > cna > affected > 1 > versions > 5 > status unaffected
containers > cna > affected > 1 > versions > 5 > versionType semver
containers > cna > affected > 1 > versions > 6 > version 6.12.49
containers > cna > affected > 1 > versions > 6 > lessThanOrEqual 6.12.*
containers > cna > affected > 1 > versions > 6 > status unaffected
containers > cna > affected > 1 > versions > 6 > versionType semver
containers > cna > affected > 1 > versions > 7 > version 6.16.9
containers > cna > affected > 1 > versions > 7 > lessThanOrEqual 6.16.*
containers > cna > affected > 1 > versions > 7 > status unaffected
containers > cna > affected > 1 > versions > 7 > versionType semver
containers > cna > affected > 1 > versions > 8 > version 6.17
containers > cna > affected > 1 > versions > 8 > lessThanOrEqual *
containers > cna > affected > 1 > versions > 8 > status unaffected
containers > cna > affected > 1 > versions > 8 > versionType original_commit_for_fix
containers > cna > cpeApplicability > 0 > nodes > 0 > operator OR
containers > cna > cpeApplicability > 0 > nodes > 0 > negate False
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionStartIncluding 2.6.38
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionEndExcluding 5.10.245
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > versionStartIncluding 2.6.38
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > versionEndExcluding 5.15.194
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > versionStartIncluding 2.6.38
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > versionEndExcluding 6.1.154
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > versionStartIncluding 2.6.38
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > versionEndExcluding 6.6.108
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > versionStartIncluding 2.6.38
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > versionEndExcluding 6.12.49
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > versionStartIncluding 2.6.38
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > versionEndExcluding 6.16.9
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > vulnerable True
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > criteria cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > versionStartIncluding 2.6.38
containers > cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > versionEndExcluding 6.17
containers > cna > references > 0 > url https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce
containers > cna > references > 1 > url https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9
containers > cna > references > 2 > url https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8
containers > cna > references > 3 > url https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84
containers > cna > references > 4 > url https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d
containers > cna > references > 5 > url https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042
containers > cna > references > 6 > url https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285
containers > cna > title crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
containers > cna > x_generator > engine bippy-1.2.0
containers > adp > 0 > metrics > 0 > other > type ssvc
containers > adp > 0 > metrics > 0 > other > content > id CVE-2025-39964
containers > adp > 0 > metrics > 0 > other > content > role CISA Coordinator
containers > adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation active
containers > adp > 0 > metrics > 0 > other > content > options > 1 > Automatable no
containers > adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact total
containers > adp > 0 > metrics > 0 > other > content > version 2.0.3
containers > adp > 0 > metrics > 0 > other > content > timestamp 2026-09-18T14:40:05.718549Z
containers > adp > 0 > references > 0 > url https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964
containers > adp > 0 > references > 0 > tags > 0 government-resource
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > lang en
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > type CWE
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > cweId CWE-362
containers > adp > 0 > problemTypes > 0 > descriptions > 0 > description CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
containers > adp > 0 > title CISA ADP Vulnrichment
containers > adp > 0 > providerMetadata > orgId 134c704f-9b21-4f2e-91b3-4a467353bcc0
containers > adp > 0 > providerMetadata > shortName CISA-ADP
containers > adp > 0 > providerMetadata > dateUpdated 2026-09-18T14:41:56.523Z
containers > adp > 1 > x_adpType supplier
containers > adp > 1 > providerMetadata > orgId 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
containers > adp > 1 > providerMetadata > shortName siemens-SADP
containers > adp > 1 > providerMetadata > dateUpdated 2026-09-08T08:42:37.537Z
containers > adp > 1 > affected > 0 > vendor Siemens
containers > adp > 1 > affected > 0 > product SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
containers > adp > 1 > affected > 0 > versions > 0 > status affected
containers > adp > 1 > affected > 0 > versions > 0 > version V3.1.6
containers > adp > 1 > affected > 0 > versions > 0 > lessThan *
containers > adp > 1 > affected > 0 > versions > 0 > versionType custom
containers > adp > 1 > affected > 0 > defaultStatus unknown
containers > adp > 1 > affected > 1 > vendor Siemens
containers > adp > 1 > affected > 1 > product SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
containers > adp > 1 > affected > 1 > versions > 0 > status affected
containers > adp > 1 > affected > 1 > versions > 0 > version V3.1.6
containers > adp > 1 > affected > 1 > versions > 0 > lessThan *
containers > adp > 1 > affected > 1 > versions > 0 > versionType custom
containers > adp > 1 > affected > 1 > defaultStatus unknown
containers > adp > 1 > affected > 2 > vendor Siemens
containers > adp > 1 > affected > 2 > product SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
containers > adp > 1 > affected > 2 > versions > 0 > status affected
containers > adp > 1 > affected > 2 > versions > 0 > version V3.1.6
containers > adp > 1 > affected > 2 > versions > 0 > lessThan *
containers > adp > 1 > affected > 2 > versions > 0 > versionType custom
containers > adp > 1 > affected > 2 > defaultStatus unknown
containers > adp > 1 > affected > 3 > vendor Siemens
containers > adp > 1 > affected > 3 > product SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
containers > adp > 1 > affected > 3 > versions > 0 > status affected
containers > adp > 1 > affected > 3 > versions > 0 > version V3.1.6
containers > adp > 1 > affected > 3 > versions > 0 > lessThan *
containers > adp > 1 > affected > 3 > versions > 0 > versionType custom
containers > adp > 1 > affected > 3 > defaultStatus unknown
containers > adp > 1 > affected > 4 > vendor Siemens
containers > adp > 1 > affected > 4 > product SIPLUS S7-1500 CPU 1518-4 PN/DP MFP
containers > adp > 1 > affected > 4 > versions > 0 > status affected
containers > adp > 1 > affected > 4 > versions > 0 > version V3.1.6
containers > adp > 1 > affected > 4 > versions > 0 > lessThan *
containers > adp > 1 > affected > 4 > versions > 0 > versionType custom
containers > adp > 1 > affected > 4 > defaultStatus unknown
containers > adp > 1 > references > 0 > url https://cert-portal.siemens.com/productcert/html/ssa-019113.html