CVE-2025-39964 Linux Kernel: Linux Kernel Race Condition Vulnerability

1. Executive summary

CVE-2025-39964 is a race condition (CWE-362) in the Linux kernel's AF_ALG cryptographic socket interface: concurrent writes to the same AF_ALG socket can interleave data unpredictably and corrupt the socket's internal state. NVD scores it CVSS 7.8 HIGH, and CISA added it to the KEV catalogue on 2026-09-18 with a remediation due date of 2026-09-21, which confirms exploitation in the wild. Exploitation requires local code execution on the target, so the exposure for EMEA financial services is concentrated in multi-tenant Linux estates: container hosts, virtualisation hosts, and any server where untrusted or partially trusted users or workloads can open AF_ALG sockets. The primary risk is integrity failure of cryptographic operations rather than direct privilege escalation, and no ransomware use is recorded. The KEV due date is three days out; patching should be treated as an immediate scheduling item.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The trigger facts available (a locally exploitable kernel flaw, a KEV listing, a vendor patch) would apply to virtually any kernel vulnerability advisory and do not change what a client must do under any single article in the regulatory reference. Clients already running DORA Art. 24 (digital operational resilience testing — general requirements) patch cycles or NIS2 Art. 21(2)(d) (supply chain security measures) programmes should fold this CVE into them, but that is programme continuity, not a new obligation triggered by this item.

3. Technical analysis & attack chain

Confirmed steps

1. Attacker obtains local code execution on a vulnerable Linux host, as an unprivileged user.
2. Attacker opens an AF_ALG socket (socket(AF_ALG, ...)), the kernel's userspace cryptographic API, and binds a cipher (for example an af_alg type hash or skcipher socket).
3. Attacker issues concurrent send()/sendmsg() writes against the same AF_ALG socket from multiple threads or processes.
4. The kernel lacks adequate locking on this path, so the concurrent writes interleave unpredictably and leave the socket's internal state inconsistent.
5. Resulting impact is data corruption and incorrect cryptographic output: hashed or encrypted results that do not correspond to any single input, or socket state that misbehaves on subsequent operations.

Vulnerability mechanism. AF_ALG exposes kernel crypto primitives to userspace. The flaw is a classic TOCTOU-style concurrency defect on the socket write path: two writers racing on one socket descriptor produce interleaved data streams and inconsistent internal state. The verified reference data classifies it CWE-362 (Race Condition), CVSS 7.8 HIGH, EPSS 0%, in CISA KEV since 2026-09-18. The EPSS score of 0% sits against the KEV listing: KEV is authoritative for exploitation, EPSS is a probabilistic model, and the KEV entry wins for prioritisation.

Attack preconditions and what that means. There is no network-facing attack path in the source material. Exploitation is local, which in practice means the attacker already has a foothold: a shell on a container, a CI runner job, a compromised low-privilege service account, or a malicious tenant on shared infrastructure. The security consequence is not privilege escalation but cryptographic integrity: any application that hashes or encrypts through AF_ALG on a host where an attacker can also write to the same socket can be fed corrupted results. For financial services this touches anything using kernel AF_ALG as a crypto backend, including some TLS offload configurations, disk encryption helpers, and language bindings that call AF_ALG rather than OpenSSL.

Discrepancies and single-source caveats. The GitHub advisory corpus-1 describes a different race condition (in tcp_getsockopt/tcp_setsockopt, TCP Handler component, VDB-211089) and corpus-3 describes an unrelated tpacket_snd() hard_header_len fix; neither matches the AF_ALG description in the primary NVD/KEV entry, and we treat them as adjacent kernel race-condition advisories rather than descriptions of this CVE. Corpus-2 describes CVE-2026-64600, an XFS filesystem privilege escalation, which is a different vulnerability and is not covered by this advisory. The BSI advisories (corpus-4, 5, 6) are aggregate Linux kernel bulletins rating local attackers able to cause denial of service or bypass security mechanisms, at "mittel" severity; they corroborate the local-attacker precondition but not the AF_ALG specifics. The AF_ALG mechanism description is single-sourced to the NVD entry; verify against the vendor patch before building detection or enforcement around the specific socket path.

4. Mitigation & containment

P1 (within 24h)

• Inventory Linux hosts and identify which run workloads that use AF_ALG (ss -f netlink will not show them; check for applications linked against AF_ALG userspace libraries, or audit socket(AF_ALG) via an auditd rule: -a always,exit -F arch=b64 -S socket -F a0=38 -k af_alg_open, where 38 is the AF_ALG domain number). This tells you where the integrity risk actually lands.
• Apply the vendor kernel update on internet-exposed or multi-tenant hosts first. The KEV due date is 2026-09-21; CISA's required action is to apply mitigations per vendor instructions, in line with BOD 26-04 risk-based patching guidance, or discontinue use of the product where mitigations are unavailable.
• If patching cannot be completed in the window, block unprivileged access to AF_ALG: sysctl does not expose a direct toggle, so use a seccomp profile or SELinux/AppArmor policy denying socket(AF_ALG, ...) for untrusted workloads, or restrict the CAP_NET_ADMIN-adjacent paths your platform exposes.

P2 (within 72h)

• Patch remaining server fleets to the vendor-fixed kernel version, prioritising hosts where multiple tenants or CI workloads share a kernel.
• For container platforms, confirm the fix is in the host kernel, not just container images: AF_ALG is a host-kernel interface and container-level updates do not remediate it.
• Verify with your Linux vendor (distribution kernel channel) which exact kernel builds contain the fix, and pin to those builds. The source material does not name specific fixed kernel versions; obtain them from your distribution's advisory for this CVE rather than assuming a mainline version number.

P3 (within 7 days)

• Add AF_ALG socket-open auditing (auditd rule above) to baseline telemetry on hardened hosts so future abuse of this interface is visible.
• Review which applications in your estate actually use AF_ALG as a crypto backend; where a userspace library (OpenSSL, GnuTLS) is an option, prefer it on hosts that cannot be patched quickly, since the vulnerability is specific to the kernel socket path.
• Record the patch state against your resilience-testing evidence for DORA Art. 24 (digital operational resilience testing — general requirements) if you maintain per-CVE patch evidence there.

5. Indicators of compromise

No indicators of compromise available in the source material. The source describes a vulnerability mechanism, not an exploit artefact, and provides no hashes, domains, IPs, or file paths. Exploitation of this CVE leaves no distinctive atomic indicator; the observable is the auditd socket(AF_ALG) event combined with anomalous multi-threaded writes from a single process, which is a behavioural signal, not an IOC.

6. Detection

Insufficient indicators to author detection rules. The sources contain no strings, file names, mutexes, command lines, or registry keys belonging to an exploit for this CVE. A YARA or Sigma rule built from the vulnerability description would match reporting about the flaw, not exploitation of it. The auditd rule in §4 (P1) is the correct detection instrument here: it fires on socket(AF_ALG, ...) syscalls and gives you the process, user, and container context needed to spot unexplained AF_ALG use on hosts where no legitimate workload should open that socket.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV)

7. Sources

• NVD, CVE-2025-39964 — Linux Kernel: Linux Kernel Race Condition Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2025-39964, 2026-09-17
• GitHub Security Advisories, GHSA-qfg2-8gf5-3xfc (Linux Kernel race condition, TCP Handler), https://github.com/advisories/GHSA-qfg2-8gf5-3xfc, undated in source
• BleepingComputer, New RefluXFS Linux flaw lets attackers gain root privileges (CVE-2026-64600, separate vulnerability), https://www.bleepingcomputer.com/news/linux/new-refluxfs-linux-flaw-lets-attackers-gain-root-privileges/, undated in source
• GitHub Security Advisories, GHSA-j5cf-5xp4-r57f (packet: use consistent hard_header_len in TX_RING send path), https://github.com/advisories/GHSA-j5cf-5xp4-r57f, undated in source
• BSI Germany, WID-SEC-2025-2132 Linux Kernel: Mehrere Schwachstellen, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2132, undated in source
• BSI Germany, WID-SEC-2024-0984 Linux Kernel: Mehrere Schwachstellen, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0984, undated in source
• BSI Germany, WID-SEC-2025-0119 Linux Kernel: Mehrere Schwachstellen, https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0119, undated in source

8. Adverse Trace position

We assess CVE-2025-39964 as HIGH severity per the verified NVD data (CVSS 7.8, CWE-362) and treat the CISA KEV listing dated 2026-09-18 as confirmation of active exploitation, notwithstanding the 0% EPSS score. Client impact is uneven: single-tenant application servers where no untrusted local code runs carry low practical exposure, while container hosts, virtualisation hosts, and CI infrastructure carry the real risk, because the attack needs a local foothold and the payoff is corrupted cryptographic output rather than root. The AF_ALG mechanism description is single-sourced to the NVD entry and the related GitHub and BSI material describes other kernel flaws; we will verify the component detail and the fixed kernel versions against distribution advisories before the next revision of this note. We will monitor for public exploit code and for any revision of the KEV entry, and we will reissue if a privilege-escalation impact is confirmed, which would raise the priority for multi-tenant estates.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.