Linux Kernel: Concurrent write flaw in AF_ALG crypto sockets
Deadline for US federal agencies: 21 Sep 2026
Summary
The AF_ALG crypto socket interface in the Linux kernel allowed two writes to the same socket at once, so data could be interleaved unpredictably and internal socket state could become inconsistent. A local user with low privileges can use this to escalate privileges, and CISA reports active exploitation. The NVD record scores it CVSS 5.5 (AV:L/AC:L/PR:L), but the KEV listing makes it a high priority for multi-user systems.
Affected
- Linux kernel from 2.6.38 up to the fixed stable releases listed below
- Exact ranges vary by stable branch; verify against the linked kernel.org commits and your distribution's kernel advisories
Fixed in
- Distribution kernel packages containing the upstream fix (preferred)
- Upstream stable releases: 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9
- Newer kernel versions: unknown, verify against the kernel.org commits
Workaround
- If no patch is available, blacklist the af_alg module (for example via /etc/modprobe.d/) and reboot. Test first, because applications that use AF_ALG will break.
- If af_alg is built into the kernel rather than loaded as a module, this measure has no effect.
Exploitation
- CISA added the vulnerability to the KEV catalog on 2026-09-18 based on evidence of active exploitation; due date 2026-09-21.
- A public proof of concept exists, which demonstrates privilege escalation and container escape in Google's kernelCTF.
- CISA has not published attack conditions or threat actors. Ransomware use is unknown.
Our recommendation
- Install the distribution kernel update that contains the fix and reboot.
- Prioritise multi-user Linux servers, shared hosts, container hosts and CI runners.
- Until patched, blacklist af_alg where feasible and monitor for unusual local activity.
- Check which systems allow untrusted local users or workloads.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (2 repositories)
n1k0oowang/CVE-2025-39964_EXP · suominen/CVE-2025-39964
Research sources
- Linux kernel stable commit 0f28c4ad git.kernel.org
- Linux kernel stable commit 1b34cbbf git.kernel.org
- CISA Known Exploited Vulnerabilities Catalog www.cisa.gov
- CISA alert on added KEV entries (2026-09-18) www.cisa.gov
- Red Hat CVE page access.redhat.com
- Google security research PoC write-up github.com
- NVD CVE-2025-39964 nvd.nist.gov
- BleepingComputer: active exploitation of Linux kernel flaws www.bleepingcomputer.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:04.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.
Required action (CISA)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
NVD references (10)
- https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce
- https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285
- https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8
- https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042
- https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84
- https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d
- https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.