CVE-2025-39964

CVE-2025-39964 is a race condition (CWE-362) in the Linux kernel's AF_ALG crypto socket interface: the af_alg_sendmsg function did not prevent concurrent writes to the same socket, so two simultaneous writes could interleave data unpredictably and leave the kernel's internal socket state inconsistent. It is triggered by a local user (or local process) issuing concurrent write/sendmsg operations on the same AF_ALG socket, which is why the CVSS v3.1 score is low (3.3, local vector, low availability impact). An attacker exploiting the race primarily gains the ability to corrupt socket state, with potential for degraded availability; confidentiality and integrity are not rated as impacted. Any Linux kernel deployment whose build includes the vulnerable af_alg code is affected, though exploitation requires the ability to run local code that uses the crypto socket API. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation in the wild per CISA, but no public proof-of-concept is known and ransomware use is unknown; EPSS estimates a 0.3% probability of exploitation in the next 30 days.

What to do: Apply a kernel update from your distribution or vendor that includes the upstream fix 'crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg'; CISA KEV requires mitigating per BOD 26-04 guidance, so prioritize internet-exposed and multi-user systems. Because the vector is local, reduce exposure by limiting untrusted local code execution and auditing hosts that expose crypto-socket workloads; verify the fix by confirming your running kernel includes the af_alg_sendmsg exclusive-ownership patch.