CVE-2025-39964 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: OTHER

CVE Published: 2025-10-13

Added to CISA KEV: 2026-09-18 340 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
Patch priority: HIGH for multi-tenant Linux systems (shared hosting, cloud VMs, container hosts) where unprivileged local users exist — unprivileged users can escalate to root
Update Linux kernel to patched versions: 5.10.245+, 5.15.194+, 6.1.154+, 6.6.108+, 6.12.49+, 6.16.9+, or 6.17+ depending on distribution
Apply distribution vendor patches: Ubuntu, Debian, RHEL/CentOS, SUSE should all have advisories — prioritize applying kernel security updates from your distribution maintainer
For Siemens SIMATIC S7-1500 MFP and SIPLUS devices: refer to Siemens SSA-019113 for vendor-specific patching guidance
Where patching is not immediately possible, restrict access to AF_ALG sockets by disabling unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 on supported distros) to reduce the attack surface for container-based exploitation
Monitor for signs of local privilege escalation attempts: unexpected root processes spawned from low-privileged users, kernel oops/panic events in system logs (dmesg), anomalous crypto socket activity
For cloud and container environments: ensure kernel isolation controls (seccomp profiles, AppArmor/SELinux policies) are applied to restrict AF_ALG socket access for untrusted workloads
This vulnerability does NOT require emergency out-of-band patching for systems without untrusted local users; normal patch cycle is acceptable for single-user or fully trusted environments

🔍 Web Intelligence (Kagi · 2026-09-18)

Summary

CVE-2025-39964 is a race condition vulnerability within the Linux kernel’s cryptographic user interface (AF_ALG) that occurs when concurrent write operations are performed on the same AF_ALG socket. This flaw allows data to be interleaved in an unpredictable manner and can lead to inconsistencies in the internal socket state, potentially compromising the integrity of cryptographic operations or system stability.

Exploitation

Active Exploitation: There are no widespread reports of active exploitation in the wild at this time.
Threat Actors/Campaigns: No specific threat actors or ransomware campaigns have been publicly linked to this vulnerability.
Proof-of-Concept: A GitHub repository (n1k0oowang/CVE-2025-39964_EXP) exists, suggesting the availability of proof-of-concept or exploit tooling.
Attack Prerequisites: The attack is local in nature, requiring the ability to interact with the kernel’s AF_ALG interface; it is not typically exploitable remotely over a network without an existing local access vector.

Affected Products & Patches

Affected Versions: The vulnerability affects various Linux kernel versions across major distributions (including Ubuntu, Debian, SUSE, and Red Hat) that have not yet incorporated the upstream patch.
Patches: The vulnerability was addressed in the Linux kernel upstream by disallowing concurrent writes in `af_alg_sendmsg` through the introduction of a `ctx->write` state field. Users should update to the latest kernel versions provided by their respective distribution maintainers.
Mitigations: Apply security updates and kernel patches issued by your Linux distribution provider as soon as they become available.

Impact

Access/Capability: Successful exploitation can result in data corruption, unpredictable system behavior, or the creation of inconsistent internal socket states within the cryptographic API.
Business Risk: While primarily a local attack, the vulnerability poses a risk to systems where untrusted local users have access to kernel interfaces. In multi-tenant environments or systems providing shell access to external users, this could be leveraged to disrupt cryptographic services or potentially lead to local privilege escalation or denial-of-service (DoS) conditions.