Skip to main content

Linux Kernel CVE-2025-39964

MEDIUM
Race Condition (CWE-362)
2025-10-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux Race Condition
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local user access
  2. Delivery
    Open AF_ALG socket
  3. Exploit
    Spawn concurrent write threads targeting same socket
  4. Execution
    Race condition interleaves data in kernel buffer
  5. Persist
    Crypto socket state corrupted
  6. Impact
    Crypto operation integrity or availability impacted

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires a local user account with the ability to create and write to an AF_ALG socket - available to any unprivileged user on a standard Linux system unless restricted by mandatory access control (SELinux, AppArmor, seccomp). The race condition is only triggered when two or more concurrent write operations target the same AF_ALG socket descriptor simultaneously, which requires either multi-threaded application code sharing a socket without synchronization or a deliberate exploit thread pair. Remote exploitation is not possible. Exploitation is limited by: (1) required local access, (2) timing dependency of the race condition, and (3) the impact being restricted to the integrity and availability of the specific crypto socket instance rather than broader system compromise.
Impact

The official CVSS 3.1 score of 3.3 (Low) with AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L reflects a local, low-privilege attack with limited availability impact, which aligns with the realistic threat model. However, AC:L may be optimistic for a race condition - reliable exploitation typically requires coordinated concurrent writes, suggesting AC:H is more accurate. No EPSS data is provided in the input; the vulnerability is not in CISA KEV and no public proof-of-concept exists, meaning real-world exploitation risk is currently low. SSVC signals support deprioritization: exploitation is not publicly demonstrated, the attack is not automatable (requires local access and timing), and technical impact is partial availability/integrity of the crypto subsystem. The Siemens advisory expands the scope to embedded industrial systems that may lack timely kernel patch cycles, representing a moderate concern for OT/ICS environments. The net assessment is a low-priority issue for most environments, elevated slightly for Siemens-product operators and any system running multi-threaded applications that share AF_ALG socket handles.
Exploit ScenarioDerived

A local unprivileged user runs a multi-threaded application that intentionally or accidentally shares a single AF_ALG socket handle across threads and issues simultaneous sendmsg() calls. The concurrent writes race within af_alg_sendmsg(), interleaving their respective data in the kernel buffer and leaving ctx in an inconsistent state, causing subsequent cryptographic operations to produce incorrect results or the socket to become unusable. No public proof-of-concept exists for this scenario.
Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 14, 2026

Concurrent write access to AF_ALG cryptographic sockets in the Linux kernel corrupts internal socket state and interleaves cryptographic data in an unpredictable manner, undermining the integrity and availability of kernel crypto operations for local users. The flaw spans multiple stable kernel branches up to and including 6.17-rc4, with six upstream patch commits available. No public exploit or active exploitation has been identified; the Siemens SSA-019113 advisory confirms downstream impact on industrial and embedded Linux-based products.

RemediationAI

Apply the upstream stable kernel patches for the relevant branch; seven commits are available at git.kernel.org/stable (see references 0f28c4ad, 1b34cbbf, 1f323a48, 45bcf60f, 7c4491b5, 9aee87da, e4c1ec11). An exact fixed release version is not independently confirmed from the available data - operators should consult their distribution's security advisories (e.g., Ubuntu USN, RHEL RHSA, SUSE SUSE-SU) for backported fixes. Siemens operators should follow SSA-019113 for vendor-specific guidance. As a compensating control where patching is not immediately feasible, restricting access to AF_ALG sockets via seccomp, SELinux, or AppArmor policies (blocking the socket(AF_ALG, ...) syscall for untrusted processes) eliminates the attack surface entirely, with the trade-off of disabling kernel-accelerated cryptography for those processes. This is low-risk in environments where userspace crypto libraries (OpenSSL, libgcrypt) serve as fallback.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

AF_ALG (AF_ALG socket family) is the Linux kernel's user-space interface to the in-kernel cryptographic API, exposed via SOCK_SEQPACKET sockets. Applications invoke cryptographic algorithms by writing plaintext or AAD to the socket via sendmsg() and reading ciphertext back. The root cause is the absence of a mutual exclusion primitive in af_alg_sendmsg(): two threads or processes sharing the same socket descriptor could issue concurrent write calls, causing their data to be interleaved within the kernel buffer and leaving the internal ctx (socket context) in an inconsistent state. The fix introduces a ctx->write flag that enforces exclusive ownership of the write path, effectively serializing sendmsg() calls. CWE is not formally assigned, but this is a textbook CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization / Race Condition). CPE confirms the affected product is the Linux kernel across a broad version range up to 6.17-rc4.

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 3.6 LOW

Race condition requires concurrent writes (AC:H); local low-privilege socket access required (PR:L); data interleaving introduces integrity impact (I:L) beyond availability alone.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
SUSE 5.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat 7.3 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Severity Changed
Sep 18, 2026 - 18:52 NVD
LOW MEDIUM
CVSS changed
Sep 18, 2026 - 18:52 NVD
3.3 (LOW) 5.5 (MEDIUM)
Added to CISA KEV
Sep 18, 2026 - 14:32 CISA
CVE Published
Oct 13, 2025 - 14:15 nvd
LOW 3.3

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state.

Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

Threat Intelligence Overview

Threat Score
6.1/10
Composite threat intelligence
EPSS Score
0.2%
Top 86% exploitable
Prevalence
Ubiquitous
Linux kernel underpins the vast majority of server, cloud, and embedded deployments globally
Threat Intel
2
1 source
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
NVD CVE.org CISA KEV EPSS CISA Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV Yes
Public POC Yes
EPSS 0.2%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Active
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

108
Low Medium High Critical
KEV: +50
EPSS: 0
CVSS: +28
PoC: +20
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Affected Products (CPE)NVD

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2015-5754 CRITICAL POC
9.3

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.168 Image SLES15-SP7-BYOS-Azure Image SLES15-SP7-BYOS-EC2 Image SLES15-SP7-BYOS-GCE Image SLES15-SP7-EC2 Image SLES15-SP7-EC2-ECS-HVM Image SLES15-SP7-GCE Image SLES15-SP7-HPC-Azure Image SLES15-SP7-HPC-BYOS-Azure Image SLES15-SP7-HPC-BYOS-EC2 Image SLES15-SP7-SAPCAL-Azure Image SLES15-SP7-SAPCAL-EC2 Image SLES15-SP7-SAPCAL-GCE Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.208 Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.218 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.237 Affected
Container suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.67 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-209-04 ICSA-26-295-11
Sources: CISA (public domain)

References

Advisories & patches
PATCH https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce PATCH https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 PATCH https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8 PATCH https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042 PATCH https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84 PATCH https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d PATCH https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9 ADVISORY https://access.redhat.com/errata/RHSA-2026:70402 ADVISORY https://access.redhat.com/errata/RHSA-2026:70403 ADVISORY https://access.redhat.com/errata/RHSA-2026:70459 ADVISORY https://access.redhat.com/errata/RHSA-2026:70498 ADVISORY https://access.redhat.com/errata/RHSA-2026:71326 ADVISORY https://access.redhat.com/errata/RHSA-2026:71327 ADVISORY https://access.redhat.com/errata/RHSA-2026:71565 ADVISORY https://access.redhat.com/errata/RHSA-2026:71569 ADVISORY https://access.redhat.com/errata/RHSA-2026:71592 ADVISORY https://access.redhat.com/errata/RHSA-2026:71594 ADVISORY https://access.redhat.com/errata/RHSA-2026:71601 ADVISORY https://access.redhat.com/errata/RHSA-2026:71606 ADVISORY https://access.redhat.com/errata/RHSA-2026:71657 ADVISORY https://access.redhat.com/errata/RHSA-2026:71687 ADVISORY https://access.redhat.com/errata/RHSA-2026:72059 ADVISORY https://vuldb.com/vuln/328120 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0962/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1041/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1078/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:1081/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20667/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20711/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20713/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20720/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20772/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20794/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20819/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20838/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20845/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20872/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20873/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20876/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20931/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21284/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23066/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23068/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23221/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23231/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23237/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23477/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23481/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23490/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23491/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23510/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23528/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:23529/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4120/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4254/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:4282/ REF https://cert-portal.siemens.com/productcert/html/ssa-019113.html REF https://cert-portal.siemens.com/productcert/html/ssa-457936.html REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy