Disclosure: this page contains affiliate links. East Bay Cyber may earn a commission if you buy through them, at no extra cost to you. That never changes how we rank products. Editorial policy.
CVE-2025-39964: Linux AF_ALG Race Condition
Active exploitation confirmed in the wild. CISA added this to the KEV catalog on 2026-09-18. Federal agencies must patch by 2026-09-21.
TL;DR
- CVE-2025-39964 is a Linux kernel race condition in AF_ALG cryptographic-socket write handling, rated 7.8 by NVD.
- Linux kernels beginning with 2.6.38 are listed as affected, with upstream fixes in 5.10.245, 5.15.194, and 6.1.154.
- CISA KEV confirms exploitation in the wild. Patch immediately and investigate exposed or multi-user systems.
Vulnerability at a Glance
| Field | Details |
|---|---|
| CVE ID | CVE-2025-39964 |
| NVD CVSS v3 base score | 7.8 |
| Attack vector | Local, based on the reported local-user and AF_ALG socket requirements; NVD did not provide the vector string in the supplied record |
| Authentication required | Authentication is not independently specified in the NVD vector data. Exploitation requires local access or an equivalent ability to execute code on the host |
| Patch status | Yes. Upstream fixes are listed at Linux 5.10.245, 5.15.194, and 6.1.154, with distribution backports handled separately |
| Affected component | Linux kernel cryptographic user API, specifically AF_ALG socket handling |
| CISA KEV status | Listed on 2026-09-18; remediation due date was 2026-09-21 |
CVE-2025-39964 affects the kernel’s AF_ALG interface, which allows user-space applications to access kernel cryptographic operations through sockets. This is not a conventional remotely reachable network-service vulnerability. Practical exposure generally depends on a local user, local workload, container, or another execution path being able to interact with the vulnerable kernel interface.
The NVD score is 7.8, but downstream vendors may publish different assessments. A Siemens advisory, for example, reports a product-specific CVSS v3.1 score of 7.0 with vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. That product score must not be substituted for the generic NVD rating.
What Is This Vulnerability?
The flaw is a race condition in af_alg_sendmsg(). Multiple threads or processes could issue writes to the same AF_ALG socket concurrently. Those writes could interleave unpredictably while shared per-socket state was modified by more than one writer at the same time.
The result could be an inconsistent cryptographic-operation context. Depending on the kernel configuration, workload, and downstream integration, consequences may include a kernel crash, denial of service, corrupted cryptographic results, or data-integrity problems. CloudLinux advisory material also describes a public exploit capable of escalating an ordinary account to root. That claim should be validated against the affected distribution and exploit details rather than assumed for every upstream kernel.
The upstream correction adds a ctx->write field that establishes exclusive ownership for a write operation. This serializes competing writers and prevents concurrent sendmsg() calls from corrupting AF_ALG socket state. The change addresses the race at the kernel implementation layer, so applications do not need to coordinate their own writers to apply the kernel fix.
Technical Notes
The affected operation is conceptually similar to the following unsafe pattern:
/* Simplified conceptual behavior, not a complete kernel implementation */
writer_a = af_alg_sendmsg(ctx, socket, data_a);
writer_b = af_alg_sendmsg(ctx, socket, data_b);
/*
* Without exclusive ownership:
* - data_a and data_b may interleave
* - shared operation state may be updated concurrently
* - the cryptographic context may become inconsistent
*/
The fix introduces write ownership in the AF_ALG context. Administrators do not need to modify application code to apply the kernel fix. Applications that share one AF_ALG socket across concurrent writers should still be reviewed because the previous behavior was invalid and inherently nondeterministic.
Who Is Affected?
The generic Linux kernel version information associated with this CVE identifies kernels beginning with 2.6.38 as affected. The upstream fixed points supplied in the vulnerability record are:
- 5.10.245 and later in the Linux 5.10 stable branch
- 5.15.194 and later in the Linux 5.15 stable branch
- 6.1.154 and later in the Linux 6.1 stable branch
These are upstream branch thresholds, not universal package-version requirements. Red Hat, CloudLinux, Debian, Ubuntu, SUSE, and other distributors can backport the fix into packages whose displayed kernel version is lower than the upstream fixed point. Use the vendor’s advisory and package changelog to determine whether a particular installed kernel contains the fix.
Siemens advisory SSA-019113 identifies affected products including the following:
| Product | Reported affected range |
|---|---|
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | Versions below V3.1.6 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | Versions below V3.1.6 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | Versions below V3.1.6 |
Consult the Siemens product matrix directly before scheduling an industrial-system upgrade. Embedded products may not expose a conventional Linux package manager, and remediation can require a firmware release rather than a host-level kernel update.
Prioritize multi-user Linux servers, shared-hosting platforms, container hosts, build systems, research systems, and internet-facing machines that provide an attacker with an initial execution path. A container boundary does not automatically eliminate risk because the vulnerable code executes in the host kernel.
CVSS Score Breakdown
NVD assigns CVE-2025-39964 a CVSS v3 base score of 7.8, which is high severity. The supplied NVD data includes the score but does not include the complete vector string. The exact NVD values for attack complexity, privileges required, user interaction, scope, confidentiality, integrity, and availability should not be reconstructed from the score alone.
Operationally, the issue is local rather than a directly remote, unauthenticated network attack. An attacker generally needs local code execution, a local account, a compromised workload, or another path that permits interaction with the AF_ALG interface. That prerequisite lowers the exposure of a hardened single-user appliance compared with a multi-user server, but it does not make the vulnerability low priority.
The Siemens product-specific vector is more detailed: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, producing a reported score of 7.0 in that advisory context. It describes local access, high attack complexity, low privileges, no user interaction, unchanged scope, and high potential impact to confidentiality, integrity, and availability. This vector applies to the Siemens assessment and should not be presented as the generic NVD vector.
Exploitation Status
Exploitation in the wild is confirmed by CISA KEV inclusion. CISA added CVE-2025-39964 to its Known Exploited Vulnerabilities catalog on 2026-09-18, with a remediation due date of 2026-09-21. Treat this as an exploited vulnerability even if no exploitation has appeared in local telemetry.
CISA does not identify a confirmed ransomware campaign for this CVE; the ransomware field is listed as Unknown. CloudLinux advisory material states that a public exploit exists and describes local privilege escalation from an ordinary account to root. The supplied research does not include a directly verified exploit repository or primary proof-of-concept URL, so the public-PoC claim remains an exploitation lead that requires validation.
Analyst’s Take: KEV status makes patch verification the first operational task, even though exploitation requires local access or an equivalent execution path. The public-PoC and privilege-escalation claims are useful investigation leads, but the supplied research does not independently verify them for every distribution.
GitHub has an advisory entry, GHSA-wr5g-mfhw-rpfj, but the available record identifies affected and patched versions as unknown and does not list a source-code repository. The absence of a conveniently verifiable public repository is not a reason to defer remediation, especially given KEV status.
Verification Checklist
Use the following checklist to confirm that remediation is complete:
- Identify all Linux systems and embedded products using affected kernel branches.
- Check each vendor advisory for backported fixes.
- Install the applicable kernel or firmware update.
- Reboot where required.
- Verify the running kernel with
uname -r. - Confirm the package changelog or vendor release notes reference CVE-2025-39964 or the equivalent fix.
- Review kernel logs, process activity, account changes, and persistence mechanisms.
- Escalate systems showing signs of privilege escalation or kernel compromise for forensic investigation.
Organizations can also compare this workflow with their broader SOC maturity model guidance to identify gaps in vulnerability prioritization, patch verification, and detection coverage.
How to Detect It
Detection should combine asset inventory, package verification, process telemetry, kernel logs, and investigation of suspicious local execution. There is no supplied indication of a universal, CVE-specific kernel log message, so defenders should not depend on a single dmesg string. Look instead for crashes, oops reports, unexpected privilege changes, and local processes using cryptographic sockets shortly before or during suspicious activity.
The following commands can identify the running kernel and search common kernel telemetry. The output is triage data, not proof that the host is vulnerable or exploited:
uname -a
cat /proc/version
# Review recent kernel messages for crashes, oops reports, and warnings
journalctl -k --since "30 days ago" | \
grep -Ei 'BUG:|Oops:|general protection fault|kernel panic|Call Trace:|af_alg|algif'
# On systems using traditional kernel logs
grep -Ei 'BUG:|Oops:|general protection fault|kernel panic|Call Trace:|af_alg|algif' \
/var/log/kern.log /var/log/messages 2>/dev/null
A useful investigation pattern is a suspicious local process followed by a privilege transition or kernel fault. SIEM analysts can correlate events with a query pattern like the following, adapting field names to the platform:
(
event.category = "process" AND
process.parent.name IN ("bash", "sh", "python", "perl", "curl", "wget")
)
AND
(
event.type = "start" OR
event.action IN ("setuid", "privilege_change", "exec")
)
AND
@timestamp within 10m of
(
message contains "general protection fault" OR
message contains "Oops:" OR
message contains "kernel panic" OR
message contains "Call Trace:"
)
AF_ALG usage alone is not malicious. Legitimate cryptographic libraries and applications may use the interface. The stronger signal is unusual local code execution combined with a crash, a new root process, unexpected changes to /etc/passwd or /etc/shadow, altered SSH configuration, or execution from temporary directories.
Teams formalizing their monitoring and response process can also review these incident response fundamentals when building investigation playbooks for kernel-level incidents.
Mitigation and Patching
The preferred remediation is to install the security update supplied by the operating-system or product vendor, reboot where required, and verify the running kernel rather than only the installed package. For upstream stable branches, the relevant fixed points are 5.10.245, 5.15.194, and 6.1.154. Distributions may provide a lower-numbered package containing the backport, so compare the installed package release with the vendor advisory.
Example upgrade commands include the following. These commands update the host according to the configured repositories; they do not prove that the specific backport is present:
# Debian or Ubuntu
sudo apt-get update
sudo apt-get install --only-upgrade linux-image-generic linux-headers-generic
sudo reboot
# RHEL, Rocky Linux, AlmaLinux, or compatible systems
sudo dnf update 'kernel*'
sudo reboot
# SUSE Linux Enterprise or openSUSE
sudo zypper patch
sudo reboot
After rebooting, confirm the active kernel and inspect the distribution advisory or package changelog:
uname -r
# Debian-family package version
dpkg-query -W -f='${Package} ${Version}\n' 'linux-image*' 2>/dev/null
# RPM-family package version and changelog
rpm -q --last kernel | head
rpm -q --changelog "$(rpm -q --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n' kernel | head -n 1)" \
2>/dev/null | grep -i -C 3 'CVE-2025-39964'
If immediate patching is impossible, restrict local access and reduce the number of untrusted workloads that can execute on the host. Review whether AF_ALG is required, and consult the operating-system vendor before disabling kernel modules or interfaces because cryptographic services may depend on them. Do not assume that unloading a module is safe or sufficient; AF_ALG functionality and kernel configuration vary by distribution.
For Siemens deployments, use SSA-019113 and the product-specific release matrix. Systems below V3.1.6 for the listed affected products should be evaluated for the applicable firmware or product update. Industrial operators should follow change-control, backup, and safety procedures rather than applying a generic Linux command directly to a controller.
Because exploitation is confirmed, investigate before and after patching. Review local account activity, process creation, setuid execution, kernel faults, unexpected reboots, persistence changes, and outbound connections from hosts exposed after 2026-09-18. If evidence suggests privilege escalation or kernel compromise, isolate the system and preserve forensic data before rebuilding.
As part of post-incident hardening, review privileged account credentials and administrator access. A centrally managed password manager such as Try 1Password → can help teams enforce unique credentials and reduce reuse across Linux administration workflows, but it does not replace kernel patching or incident response.
Technical Notes
The upstream fix is represented by Linux stable commits referenced by the vulnerability record, including:
0f28c4adbc4a97437874c9b669fd7958a8c6d6ce1b34cbbf4f011a121ef7b2d7d6e6920a036d52851f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c845bcf60fe49b37daab1acee57b27211ad15740427c4491b5644e3a3708f3dbd7591be0a570135b84
The patch adds exclusive write ownership through ctx->write and prevents concurrent writers from operating on the same AF_ALG socket. Package maintainers may carry an equivalent backport without exposing the same commit identifier in the local package metadata.
References
- NVD: CVE-2025-39964
- Siemens SSA-019113
- Red Hat CVE-2025-39964
- GitHub Advisory GHSA-wr5g-mfhw-rpfj
- Linux kernel stable commit 0f28c4ad
- Linux kernel stable commit 1b34cbbf
- Linux kernel stable commit 1f323a48
- Linux kernel stable commit 45bcf60f
- Linux kernel stable commit 7c4491b5
- Linux kernel CVE process documentation
The supplied research identifies CISA KEV inclusion and the 2026-09-18 addition date, confirming exploitation in the wild. It does not provide independently verified social-mention, GitHub-reference, or EPSS-percentile counts; the corresponding metadata fields are therefore recorded as zero rather than treated as measured evidence.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.