Linux Kernel Race Condition Vulnerability

🚨SEVERITY: HIGH — CVSS 7.8Security Advisory

TL;DR 📌

  • Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket’s internal state.
  • Highest CVSS: 7.8 (High).
  • Listed in CISA KEV (2026-09-18) — this is being exploited in the wild.
  • Fixed in 5.10.245, 5.15.194, 6.1.154, 6.12.49 — upgrade to this release or later.
  • CVEs: CVE-2025-39964.

What it is

CVE-2025-39964 is a race condition in the Linux kernel’s AF_ALG socket interface, the interface the kernel crypto API exposes to userspace (used via af_alg, the same layer that underpins tools such as AF_ALG-based crypto acceleration). The bug sits in af_alg_sendmsg.

The flaw is that the kernel does not prevent two concurrent writes to the same AF_ALG socket. If a process issues overlapping writes, the data gets interleaved unpredictably, and the socket’s internal state can end up inconsistent. The fix adds a ctx->write field to enforce exclusive ownership for writing, so a second concurrent write is rejected rather than allowed to race.

The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates this requires local access and low privileges, not a remote or unauthenticated network path. The impact rating is high across confidentiality, integrity and availability, consistent with a kernel-level memory/state corruption bug reachable from a low-privileged local user with access to the AF_ALG socket.

This CVE is listed in CISA’s Known Exploited Vulnerabilities catalogue, added 18 September 2026.

What to do

  • Update to a kernel version containing the fix: 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, or 6.16.9, depending on your branch.
  • Prioritise systems where local users or processes have access to AF_ALG sockets (e.g. crypto offload configurations), since the flaw requires local access with low privileges.
  • Given the KEV listing, treat this as a patching priority for affected fleets rather than a routine kernel bump; confirm your distribution’s kernel package has backported the af_alg_sendmsg fix if you are not tracking upstream releases directly.
  • Where immediate patching isn’t possible, review which local accounts or containerised workloads can reach AF_ALG sockets and restrict that access as an interim mitigation.

For leadership 🧭

Executive summary. A known-exploited kernel flaw lets a local, low-privileged user or process corrupt kernel state via the AF_ALG crypto socket interface, with high impact across confidentiality, integrity and availability. Because it is already in CISA’s KEV catalogue, affected kernels should be patched as a priority rather than on a routine cycle.

Why it matters:

  • The bug lives in af_alg_sendmsg, part of the kernel crypto API exposed via AF_ALG sockets, which is used by crypto offload and acceleration setups where local processes write directly to the kernel.
  • No special privileges or user interaction beyond local, low-privileged access are needed (AV:L/AC:L/PR:L/UI:N), so any tenant, container, or compromised low-privilege account with socket access is a viable path.
  • Concurrent writes interleave unpredictably and can leave the socket’s internal state inconsistent, giving high-severity confidentiality, integrity and availability impact at the kernel level.
  • The vulnerability is listed in CISA’s KEV catalogue, meaning it is being treated as an active patching priority for exposed fleets.

Now / Next / Later:

  • Now: Identify which hosts run kernels affected by CVE-2025-39964 and check whether local users, containers, or offload workloads can reach AF_ALG sockets on them.
  • Next: Patch to a fixed kernel branch version (5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, or 6.16.9) or confirm your distribution has backported the af_alg_sendmsg fix, prioritising hosts with crypto offload or multi-tenant local access.
  • Later: Establish a process to track and confirm upstream kernel security fixes are backported into distribution packages promptly, and restrict which local accounts or containerised workloads can access AF_ALG sockets by default.

Source