CVE-2025-39964: Linux Kernel AF_ALG Concurrent-Write Race Condition (KEV)

CVE-2025-39964 is a race condition in the Linux kernel's AF_ALG crypto-socket write path that lets a local user issue two concurrent writes to the same socket, corrupting its internal state, and CISA added it to the KEV catalog on 2026-09-18 based on evidence of active exploitation even though public reporting has not detailed the exact in-the-wild technique or outcome.

CVE-2025-39964 is a concurrent-execution race condition (CWE-362) in the af_alg_sendmsg function of the Linux kernel's crypto subsystem. The upstream fix commit describes it directly: "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg. Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing" (NVD).

NVD lists the CVE as "Analyzed" with an NVD Primary CVSS v3.1 base score of 5.5 (medium), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, and a higher Secondary CVSS v3.1 score of 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, submitted by the Linux kernel CNA. Unusually for this site's coverage, NVD's own Primary assessment here is the lower of the two scores, rating the impact as availability-only rather than the kernel CNA's full confidentiality/integrity/availability rating — a reminder that CNA Secondary scores are not always higher than NVD's Primary figure (NVD).

The affected range spans Linux kernel 2.6.38 through 6.17-rc6 across all stable branches, and the kernel.org fix is distributed as a set of backport patches to each maintained stable branch rather than a single release (NVD). Siemens' own advisory for its SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP module — which runs an embedded GNU/Linux subsystem — lists CVE-2025-39964 among the kernel CVEs affecting that firmware and states "Currently no fix is available" for it on that specific product, recommending instead to "only build and run applications from trusted sources" and to "limit access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only" (Siemens ProductCERT SSA-019113).

CISA added CVE-2025-39964 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-18, with a required-action due date of 2026-09-21, alongside two other kernel CVEs from the same disclosure batch — a TLS-receive-path flaw (CVE-2025-39682) and an ebtables SNAT out-of-bounds write (CVE-2026-53266, already covered on this site). CISA's listing states the race condition causes data to be "unpredictably interleaved" and creates "inconsistencies in the socket's internal state," and records known ransomware campaign use as "Unknown" (CISA KEV). Security researchers have noted that a KEV listing does not by itself reveal the exploitation technique: public write-ups confirm that working proof-of-concept exploit code exists and that alg_create(), alg_bind() and alg_setkey() perform no capability checks, so any unprivileged local user — including inside a container or unprivileged user namespace — can open, bind and write to an AF_ALG socket, but they stop short of confirming whether observed in-the-wild exploitation achieved a container escape or only denial of service.

As of 2026-10-28, FIRST scores the probability of exploitation at 0.0157 (75.3rd percentile) (FIRST EPSS).

Because this is a local-privilege/local-access bug rather than a remote one, the priority is patching systems — containers and multi-tenant hosts especially — where untrusted local users or unprivileged namespaces can reach AF_ALG sockets; Linux distributions should apply their vendor's backport of the upstream fix, and embedded Linux subsystems such as Siemens' SIMATIC S7-1500 GNU/Linux environment that have no vendor fix available should restrict shell access to trusted personnel as the vendor recommends.

• Race condition in af_alg_sendmsg: concurrent writes to the same AF_ALG socket interleave data unpredictably and create internal socket-state inconsistencies; fixed by adding exclusive write ownership via a new ctx->write field (CWE-362). — NVD
• NVD status Analyzed; NVD Primary CVSS v3.1 score is 5.5 (availability-only impact), lower than the Linux kernel CNA's Secondary score of 7.8 (full C/I/A impact) — an unusual case where the CNA score exceeds NVD's own Primary rating. — NVD
• Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP's embedded GNU/Linux subsystem is affected by CVE-2025-39964 with no fix currently available; Siemens recommends restricting trust and shell access as mitigation. — Siemens ProductCERT SSA-019113
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-18, required-action due date 2026-09-21, added alongside CVE-2025-39682 and CVE-2026-53266 from the same batch, ransomware campaign use listed as Unknown. — CISA KEV
• EPSS score is 0.0157 (75.3rd percentile) as of 2026-10-28. — FIRST EPSS