Linux Kernel af_alg_sendmsg Race Condition Vulnerability Advisory (CVE-2025-39964)
Executive & SecOps Summary
SECOPS ASSESSMENTAll systems and services utilizing the Linux Kernel Crypto API (AF_ALG) interface.
Internal socket state inconsistency and potential Denial of Service (DoS) due to concurrent write operations.
Update to the latest stable kernel version provided by your distribution and reboot.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUNDThe vulnerability is mitigated by implementing a lock mechanism using a new ctx->write field to ensure exclusive ownership during write operations.
- Update via Package Manager (Ubuntu/Debian):
sudo apt update && sudo apt upgrade linux-image-generic- Update via Package Manager (RHEL/CentOS/AlmaLinux):
sudo yum update kernel- Verification:
After updating, reboot the system and verify the kernel version using uname -r to ensure the patch is active.
Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
A race condition (CWE-362) has been identified in the af_alg_sendmsg function within the Linux kernel's crypto subsystem. Issuing concurrent write operations to the same af_alg socket allows data to be interleaved in an unpredictable manner, leading to inconsistencies in the internal socket state. This flaw can be exploited by a local attacker to cause system instability or a kernel panic. Given its inclusion in the CISA KEV catalog and a high EPSS score of 0.94, this vulnerability represents a significant risk for production environments.
Official Vendor Advisories & References
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.