CVE-2025-39964

The Linux kernel is the core layer that lets software use a computer’s hardware. This flaw can let a person already on a machine interfere with a sensitive internal service by sending conflicting requests at the same time—like two people changing the same ledger entry simultaneously, leaving it unreliable or exposed.

This matters to you if you run the Linux kernel on business servers, workstations, virtual machines, network appliances, or equipment whose supplier provides Linux-based firmware. The attacker must already have access to the affected machine, such as through a local account or a compromised workload.

Attackers are already exploiting this vulnerability in real-world attacks, and CISA has placed it on its Known Exploited Vulnerabilities list. Treat this as an emergency: CISA’s remediation due date is September 21, 2026; isolate or restrict affected systems if your vendor update cannot be installed in time.

Confirm exposure by inventorying running kernel versions with uname -r, then map each version to the security advisory from the operating-system, appliance, or firmware vendor. For the Linux 5.10 stable branch, target 5.10.245 or later; other maintained branches need a vendor kernel package that includes one of the published backports: 0f28c4adbc4a97437874c9b669fd7958a8c6d6ce, e4c1ec11132ec466f7362a95f36a506ce4dc08c9, 1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8, 7c4491b5644e3a3708f3dbd7591be0a570135b84, 9aee87da5572b3a14075f501752e209801160d3d, 45bcf60fe49b37daab1acee57b27211ad1574042, or 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285.

Use the normal vendor kernel or firmware upgrade path rather than building an upstream kernel unless you operate that process already; kernel upgrades normally require a reboot and may require validation of third-party drivers. If patching is delayed, limit untrusted local users and container workloads that could access AF_ALG sockets, and apply the vendor’s available mitigation guidance. CISA’s KEV due date is 2026-09-21. After remediation, verify the booted kernel version and investigate unexpected local accounts, container escapes, or unusual processes on affected systems because exploitation is confirmed.

CVE-2025-39964 is rated CVSS 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and is a CWE-362 race condition in af_alg_sendmsg. Concurrent writes to the same AF_ALG socket can interleave data unpredictably and cause inconsistent internal socket state; the fix enforces exclusive write ownership. CISA added the CVE to KEV on 2026-09-18, which confirms real-world exploitation, and a public GitHub proof of concept is known. EPSS is not included because confirmed exploitation takes precedence.