CVE Details
CVE-2025-39964
Linux Kernel Race Condition Vulnerability
Published: 2026-09-18
CVSS: 7.8 HIGH
Product: Linux Kernel
Due Date: 2026-09-21
Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
GitHub PoC
Warning: GitHub PoC repositories are unverified. Some may be fake
or contain malware. Use caution and review code before running anything.
FIRST EPSS
EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.
Timeline
CVE Stalker
KEV
MITRE
GitHub
FIRST (EPSS)
MITRE
CVSS
SSVC
References
Show Raw Data
| Key | Remaining Key | Value |
|---|---|---|
| dataType | CVE_RECORD | |
| dataVersion | 5.2 | |
| cveMetadata > | cveId | CVE-2025-39964 |
| cveMetadata > | assignerOrgId | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| cveMetadata > | state | PUBLISHED |
| cveMetadata > | assignerShortName | Linux |
| cveMetadata > | dateReserved | 2025-04-16T07:20:57.149Z |
| cveMetadata > | datePublished | 2025-10-13T13:48:30.334Z |
| cveMetadata > | dateUpdated | 2026-09-18T14:41:56.523Z |
| containers > | cna > providerMetadata > orgId | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| containers > | cna > providerMetadata > shortName | Linux |
| containers > | cna > providerMetadata > dateUpdated | 2026-08-05T12:06:33.126Z |
| containers > | cna > descriptions > 0 > lang | en |
| containers > | cna > descriptions > 0 > value | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing. |
| containers > | cna > metrics > 0 > cvssV3_1 > version | 3.1 |
| containers > | cna > metrics > 0 > cvssV3_1 > vectorString | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| containers > | cna > metrics > 0 > cvssV3_1 > baseScore | 7.8 |
| containers > | cna > metrics > 0 > cvssV3_1 > baseSeverity | HIGH |
| containers > | cna > metrics > 0 > scenarios > 0 > lang | en |
| containers > | cna > metrics > 0 > scenarios > 0 > value | AV:L - The vulnerability is reached through the AF_ALG socket family via `socket()`/`bind()`/`sendmsg()`/`recvmsg()` syscalls, which requires local system access. There is no remote or adjacent-network path to `af_alg_sendmsg()`. AC:L - The attacker controls both sides of the race entirely — two of its own threads on a socket it owns — and can force writer A to park deterministically in `af_alg_wait_for_wmem()` by sizing `SO_SNDBUF` and filling it, then wake it on demand with its own `recvmsg()`. The error exit that leaves `cur == 0` is triggered at will with a deliberately faulting user buffer, so no condition is outside the attacker's control. PR:L - `alg_create()`, `alg_bind()` and `alg_setkey()` perform no capability checks whatsoever, so any unprivileged local user — including one inside a container or unprivileged user namespace — can open, bind and write to an AF_ALG skcipher/aead socket. The required modules are auto-loaded on demand via `MODULE_ALIAS_NETPROTO(AF_ALG)` and `request_module("algif-%s")`. UI:N - The attacking process performs every step itself — socket creation, bind, and the two concurrent `sendmsg()` calls. No victim action or interaction of any kind is needed. S:U - The corruption is confined to kernel heap objects (`struct af_alg_tsgl`/scatterlist and adjacent slab memory) within the same security authority. No hypervisor, IOMMU, or other trust boundary is crossed. C:H - The out-of-bounds scatterlist entry is fabricated from kernel list pointers and is subsequently handed to the cipher by `skcipher_recvmsg`/`aead_recvmsg` via `af_alg_pull_tsgl()`, so arbitrary kernel memory is encrypted/decrypted and returned to userspace. This yields a kernel memory disclosure primitive, not merely a pointer leak. I:H - `memcpy_from_msg(page_address(sg_page(sg)) + sg->offset + sg->length, msg, len)` on the underflowed scatterlist writes attacker-controlled data of attacker-chosen length to an address derived from attacker-influenceable heap contents. Combined with heap grooming of the 4KB tsgl allocations, this is a controlled kernel write suitable for privilege escalation. A:H - Dereferencing `page_address(sg_page(sg))` on a bogus page_link, and the later `put_page()` on that fabricated page, reliably produce an oops/panic or page refcount corruption. Any unprivileged user can trigger this repeatedly, crashing the machine. |
| containers > | cna > affected > 0 > product | Linux |
| containers > | cna > affected > 0 > vendor | Linux |
| containers > | cna > affected > 0 > defaultStatus | unaffected |
| containers > | cna > affected > 0 > repo | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git |
| containers > | cna > affected > 0 > programFiles > 0 | crypto/af_alg.c |
| containers > | cna > affected > 0 > programFiles > 1 | include/crypto/if_alg.h |
| containers > | cna > affected > 0 > versions > 0 > version | 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 |
| containers > | cna > affected > 0 > versions > 0 > lessThan | 0f28c4adbc4a97437874c9b669fd7958a8c6d6ce |
| containers > | cna > affected > 0 > versions > 0 > status | affected |
| containers > | cna > affected > 0 > versions > 0 > versionType | git |
| containers > | cna > affected > 0 > versions > 1 > version | 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 |
| containers > | cna > affected > 0 > versions > 1 > lessThan | e4c1ec11132ec466f7362a95f36a506ce4dc08c9 |
| containers > | cna > affected > 0 > versions > 1 > status | affected |
| containers > | cna > affected > 0 > versions > 1 > versionType | git |
| containers > | cna > affected > 0 > versions > 2 > version | 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 |
| containers > | cna > affected > 0 > versions > 2 > lessThan | 1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8 |
| containers > | cna > affected > 0 > versions > 2 > status | affected |
| containers > | cna > affected > 0 > versions > 2 > versionType | git |
| containers > | cna > affected > 0 > versions > 3 > version | 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 |
| containers > | cna > affected > 0 > versions > 3 > lessThan | 7c4491b5644e3a3708f3dbd7591be0a570135b84 |
| containers > | cna > affected > 0 > versions > 3 > status | affected |
| containers > | cna > affected > 0 > versions > 3 > versionType | git |
| containers > | cna > affected > 0 > versions > 4 > version | 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 |
| containers > | cna > affected > 0 > versions > 4 > lessThan | 9aee87da5572b3a14075f501752e209801160d3d |
| containers > | cna > affected > 0 > versions > 4 > status | affected |
| containers > | cna > affected > 0 > versions > 4 > versionType | git |
| containers > | cna > affected > 0 > versions > 5 > version | 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 |
| containers > | cna > affected > 0 > versions > 5 > lessThan | 45bcf60fe49b37daab1acee57b27211ad1574042 |
| containers > | cna > affected > 0 > versions > 5 > status | affected |
| containers > | cna > affected > 0 > versions > 5 > versionType | git |
| containers > | cna > affected > 0 > versions > 6 > version | 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 |
| containers > | cna > affected > 0 > versions > 6 > lessThan | 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 |
| containers > | cna > affected > 0 > versions > 6 > status | affected |
| containers > | cna > affected > 0 > versions > 6 > versionType | git |
| containers > | cna > affected > 1 > product | Linux |
| containers > | cna > affected > 1 > vendor | Linux |
| containers > | cna > affected > 1 > defaultStatus | affected |
| containers > | cna > affected > 1 > repo | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git |
| containers > | cna > affected > 1 > programFiles > 0 | crypto/af_alg.c |
| containers > | cna > affected > 1 > programFiles > 1 | include/crypto/if_alg.h |
| containers > | cna > affected > 1 > versions > 0 > version | 2.6.38 |
| containers > | cna > affected > 1 > versions > 0 > status | affected |
| containers > | cna > affected > 1 > versions > 1 > version | 0 |
| containers > | cna > affected > 1 > versions > 1 > lessThan | 2.6.38 |
| containers > | cna > affected > 1 > versions > 1 > status | unaffected |
| containers > | cna > affected > 1 > versions > 1 > versionType | semver |
| containers > | cna > affected > 1 > versions > 2 > version | 5.10.245 |
| containers > | cna > affected > 1 > versions > 2 > lessThanOrEqual | 5.10.* |
| containers > | cna > affected > 1 > versions > 2 > status | unaffected |
| containers > | cna > affected > 1 > versions > 2 > versionType | semver |
| containers > | cna > affected > 1 > versions > 3 > version | 5.15.194 |
| containers > | cna > affected > 1 > versions > 3 > lessThanOrEqual | 5.15.* |
| containers > | cna > affected > 1 > versions > 3 > status | unaffected |
| containers > | cna > affected > 1 > versions > 3 > versionType | semver |
| containers > | cna > affected > 1 > versions > 4 > version | 6.1.154 |
| containers > | cna > affected > 1 > versions > 4 > lessThanOrEqual | 6.1.* |
| containers > | cna > affected > 1 > versions > 4 > status | unaffected |
| containers > | cna > affected > 1 > versions > 4 > versionType | semver |
| containers > | cna > affected > 1 > versions > 5 > version | 6.6.108 |
| containers > | cna > affected > 1 > versions > 5 > lessThanOrEqual | 6.6.* |
| containers > | cna > affected > 1 > versions > 5 > status | unaffected |
| containers > | cna > affected > 1 > versions > 5 > versionType | semver |
| containers > | cna > affected > 1 > versions > 6 > version | 6.12.49 |
| containers > | cna > affected > 1 > versions > 6 > lessThanOrEqual | 6.12.* |
| containers > | cna > affected > 1 > versions > 6 > status | unaffected |
| containers > | cna > affected > 1 > versions > 6 > versionType | semver |
| containers > | cna > affected > 1 > versions > 7 > version | 6.16.9 |
| containers > | cna > affected > 1 > versions > 7 > lessThanOrEqual | 6.16.* |
| containers > | cna > affected > 1 > versions > 7 > status | unaffected |
| containers > | cna > affected > 1 > versions > 7 > versionType | semver |
| containers > | cna > affected > 1 > versions > 8 > version | 6.17 |
| containers > | cna > affected > 1 > versions > 8 > lessThanOrEqual | * |
| containers > | cna > affected > 1 > versions > 8 > status | unaffected |
| containers > | cna > affected > 1 > versions > 8 > versionType | original_commit_for_fix |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > operator | OR |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > negate | False |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionStartIncluding | 2.6.38 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionEndExcluding | 5.10.245 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > versionStartIncluding | 2.6.38 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > versionEndExcluding | 5.15.194 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > versionStartIncluding | 2.6.38 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > versionEndExcluding | 6.1.154 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > versionStartIncluding | 2.6.38 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > versionEndExcluding | 6.6.108 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > versionStartIncluding | 2.6.38 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > versionEndExcluding | 6.12.49 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > versionStartIncluding | 2.6.38 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 5 > versionEndExcluding | 6.16.9 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > versionStartIncluding | 2.6.38 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 6 > versionEndExcluding | 6.17 |
| containers > | cna > references > 0 > url | https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce |
| containers > | cna > references > 1 > url | https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9 |
| containers > | cna > references > 2 > url | https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8 |
| containers > | cna > references > 3 > url | https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84 |
| containers > | cna > references > 4 > url | https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d |
| containers > | cna > references > 5 > url | https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042 |
| containers > | cna > references > 6 > url | https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 |
| containers > | cna > title | crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg |
| containers > | cna > x_generator > engine | bippy-1.2.0 |
| containers > | adp > 0 > metrics > 0 > other > type | ssvc |
| containers > | adp > 0 > metrics > 0 > other > content > id | CVE-2025-39964 |
| containers > | adp > 0 > metrics > 0 > other > content > role | CISA Coordinator |
| containers > | adp > 0 > metrics > 0 > other > content > options > 0 > Exploitation | active |
| containers > | adp > 0 > metrics > 0 > other > content > options > 1 > Automatable | no |
| containers > | adp > 0 > metrics > 0 > other > content > options > 2 > Technical Impact | total |
| containers > | adp > 0 > metrics > 0 > other > content > version | 2.0.3 |
| containers > | adp > 0 > metrics > 0 > other > content > timestamp | 2026-09-18T14:40:05.718549Z |
| containers > | adp > 0 > references > 0 > url | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964 |
| containers > | adp > 0 > references > 0 > tags > 0 | government-resource |
| containers > | adp > 0 > problemTypes > 0 > descriptions > 0 > lang | en |
| containers > | adp > 0 > problemTypes > 0 > descriptions > 0 > type | CWE |
| containers > | adp > 0 > problemTypes > 0 > descriptions > 0 > cweId | CWE-362 |
| containers > | adp > 0 > problemTypes > 0 > descriptions > 0 > description | CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| containers > | adp > 0 > title | CISA ADP Vulnrichment |
| containers > | adp > 0 > providerMetadata > orgId | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| containers > | adp > 0 > providerMetadata > shortName | CISA-ADP |
| containers > | adp > 0 > providerMetadata > dateUpdated | 2026-09-18T14:41:56.523Z |
| containers > | adp > 1 > x_adpType | supplier |
| containers > | adp > 1 > providerMetadata > orgId | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e |
| containers > | adp > 1 > providerMetadata > shortName | siemens-SADP |
| containers > | adp > 1 > providerMetadata > dateUpdated | 2026-09-08T08:42:37.537Z |
| containers > | adp > 1 > affected > 0 > vendor | Siemens |
| containers > | adp > 1 > affected > 0 > product | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
| containers > | adp > 1 > affected > 0 > versions > 0 > status | affected |
| containers > | adp > 1 > affected > 0 > versions > 0 > version | V3.1.6 |
| containers > | adp > 1 > affected > 0 > versions > 0 > lessThan | * |
| containers > | adp > 1 > affected > 0 > versions > 0 > versionType | custom |
| containers > | adp > 1 > affected > 0 > defaultStatus | unknown |
| containers > | adp > 1 > affected > 1 > vendor | Siemens |
| containers > | adp > 1 > affected > 1 > product | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP |
| containers > | adp > 1 > affected > 1 > versions > 0 > status | affected |
| containers > | adp > 1 > affected > 1 > versions > 0 > version | V3.1.6 |
| containers > | adp > 1 > affected > 1 > versions > 0 > lessThan | * |
| containers > | adp > 1 > affected > 1 > versions > 0 > versionType | custom |
| containers > | adp > 1 > affected > 1 > defaultStatus | unknown |
| containers > | adp > 1 > affected > 2 > vendor | Siemens |
| containers > | adp > 1 > affected > 2 > product | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
| containers > | adp > 1 > affected > 2 > versions > 0 > status | affected |
| containers > | adp > 1 > affected > 2 > versions > 0 > version | V3.1.6 |
| containers > | adp > 1 > affected > 2 > versions > 0 > lessThan | * |
| containers > | adp > 1 > affected > 2 > versions > 0 > versionType | custom |
| containers > | adp > 1 > affected > 2 > defaultStatus | unknown |
| containers > | adp > 1 > affected > 3 > vendor | Siemens |
| containers > | adp > 1 > affected > 3 > product | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP |
| containers > | adp > 1 > affected > 3 > versions > 0 > status | affected |
| containers > | adp > 1 > affected > 3 > versions > 0 > version | V3.1.6 |
| containers > | adp > 1 > affected > 3 > versions > 0 > lessThan | * |
| containers > | adp > 1 > affected > 3 > versions > 0 > versionType | custom |
| containers > | adp > 1 > affected > 3 > defaultStatus | unknown |
| containers > | adp > 1 > affected > 4 > vendor | Siemens |
| containers > | adp > 1 > affected > 4 > product | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP |
| containers > | adp > 1 > affected > 4 > versions > 0 > status | affected |
| containers > | adp > 1 > affected > 4 > versions > 0 > version | V3.1.6 |
| containers > | adp > 1 > affected > 4 > versions > 0 > lessThan | * |
| containers > | adp > 1 > affected > 4 > versions > 0 > versionType | custom |
| containers > | adp > 1 > affected > 4 > defaultStatus | unknown |
| containers > | adp > 1 > references > 0 > url | https://cert-portal.siemens.com/productcert/html/ssa-019113.html |