CVE-2025-39964

What is AF_ALG?

AF_ALG is the Linux kernel's user-space cryptographic API. A process creates a socket in the AF_ALG address family, binds it to a named algorithm such as skcipher aes-cbc or hash sha256, accepts a per-operation socket from it, then feeds plaintext in with sendmsg() and reads the result back with recvmsg(). The point is to let userspace reach kernel crypto drivers, including hardware accelerators that have no other interface.

It is used by cryptsetup and libgcrypt paths that prefer kernel implementations, by embedded and industrial systems with crypto offload engines, and by anything that wants FIPS-validated kernel crypto without linking a userspace library. It is also a long-standing favorite of kernel exploit writers, because any unprivileged process can open one and drive complex kernel state machines with nothing but socket syscalls.

Overview

CVE-2025-39964 is a race condition in af_alg_sendmsg(). Nothing stopped two threads from writing to the same AF_ALG socket at the same time. That is a meaningless thing for an application to do on purpose, since the payloads interleave unpredictably, but the kernel treated it as permitted and carried on: the two writers manipulate the same request context, so the socket's internal accounting of buffers and pending request state can be left inconsistent.

The upstream fix adds a ctx->write field that marks exclusive write ownership, so a second concurrent sendmsg() is rejected rather than allowed to interleave.

Scoring for this CVE is unusually spread out, and the disagreement is worth understanding before triaging it. NVD scores it 3.3 LOW, treating the impact as a limited availability problem. Red Hat scores it 5.5 MODERATE, availability only. The Linux kernel CNA and CISA-ADP score it 7.8 HIGH with full confidentiality, integrity and availability impact, which is the figure this page carries and which implies memory corruption reachable from an unprivileged local process. CISA's decision to add it to KEV on 2026-09-18 indicates the higher reading is the one that matched observed attacks.

Affected Versions

The vulnerable code dates to 2.6.38, so the practical answer is that every kernel in service is affected unless it carries one of the backports above. Long-term distribution kernels take the fix through vendor errata rather than by version number, so check the vendor tracker rather than uname -r alone.

Technical Details

CWE-362, concurrent execution using a shared resource without proper synchronization. In plain terms: two code paths touch the same data at the same time and the code assumed that could not happen. Here the shared resource is the AF_ALG socket's request context, and the missing synchronization is any serialization of writers at all.

Attack characteristics are local and cheap. The attacker needs the ability to run code and open an AF_ALG socket, which any unprivileged user has by default on a kernel with the module available, including code running inside an unprivileged container. No user interaction is needed. Complexity is rated low, though as with every race the attacker must still win a timing window, typically by spinning two threads pinned to different CPUs and issuing overlapping sendmsg() calls in a loop until the interleaving lands.

The resulting inconsistent socket state is what makes this more than a data-corruption bug: request buffers tracked twice or released twice are the raw material for a use-after-free, which is consistent with the kernel CNA's 7.8 confidentiality-integrity-availability scoring and with use as a local privilege-escalation primitive.

Discovery

No external researcher is credited in the public record. The fix, "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg", was developed inside the kernel crypto subsystem and merged through the crypto tree, then backported across the stable branches for the 2025-10-13 release. Kernel CVEs handled this way are commonly the product of internal hardening work or automated fuzzing rather than an outside disclosure, but no public source confirms which applies here.

Exploitation Context

CISA added CVE-2025-39964 to the Known Exploited Vulnerabilities catalog on 2026-09-18 with a remediation deadline of 2026-09-21, alongside two other Linux kernel entries. CISA has published no indicators, victim detail, or actor attribution, and no vendor incident reporting linking the bug to a named campaign had appeared at the time of writing. Security press coverage of the KEV addition repeats CISA's exploitation claim without adding independent evidence.

EPSS put the 30-day exploitation probability at roughly 0.25 percent before the KEV listing, a reminder that EPSS models public exploit chatter rather than targeted use. There is no meaningful internet exposure figure for this one: it is not a listening service, and the population at risk is every multi-user or multi-tenant Linux host running an unpatched kernel. Siemens has flagged SIMATIC S7-1500 controllers as affected, which extends the blast radius into OT environments where kernel patching lags by design.

Remediation

1. Patch to a fixed kernel: 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, or 6.17 and later. On enterprise distributions apply the vendor erratum that references this CVE rather than matching upstream version numbers.
2. Reboot after installing, or apply a livepatch where your distribution ships one. An updated package that is not running is not a fix.
3. Where patching must wait, block the module. Red Hat's guidance for this CVE is to prevent af_alg from autoloading, which removes the attack surface entirely. Blacklist it and add install af_alg /bin/true to a modprobe configuration file, then confirm nothing on the host depends on the kernel crypto user API first: some cryptsetup configurations, FIPS-mode tooling, and hardware offload paths do.
4. Constrain local execution. Restrict untrusted local accounts and unprivileged containers, and where you run seccomp profiles, deny the socket(AF_ALG, ...) path for workloads that have no legitimate use for it.
5. For industrial systems, follow the Siemens advisory for SIMATIC S7-1500 and SIPLUS S7-1500 CPUs at V3.1.6 and below, and keep those controllers on isolated network segments unreachable from general-purpose IT networks.
6. Review kernel logs for oopses, warnings, or panics referencing af_alg, skcipher_recvmsg, or hash_sendmsg. Federal civilian executive branch agencies must remediate by 2026-09-21 under CISA BOD 26-04.