CVE-2025-39964

Name of the Vulnerable Software and Affected Versions Linux Kernel versions 2.6.38 through prior to late 2025

Description A race condition exists in the AF ALG cryptographic interface of the Linux kernel, specifically within the af alg sendmsg() function and the algif skcipher and algif aead implementations. The issue occurs when two threads issue concurrent writes to the same AF ALG socket, causing data to be interleaved unpredictably and creating inconsistencies in the internal socket state. This flaw can be exploited to trigger an out-of-bounds access on the scatterlist array, leading to controlled memory corruption. Attackers can use this to achieve arbitrary kernel write access, bypass KASLR (Kernel Address Space Layout Randomization), and escalate privileges to root. In certain Docker environments, this can be used to escape the container and compromise the host system. The exploit targets the core pattern setting to execute attacker-controlled code.

Recommendations Update the Linux kernel through the distribution provider and reboot into the patched kernel. As a temporary mitigation for container environments, enforce seccomp profiles that block AF ALG family sockets unless they are explicitly required.