STAR Labs (Organization): news timeline & CVEs

How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail

Researcher details CVE-2025-39964, an AF_ALG race that gave unprivileged Linux users root and a $113,337 kernelCTF prize.

Muhammad Alifa Ramdhan, with Bing-Jhong Billy Jheng at STAR Labs, describes finding CVE-2025-39964, a race between writers sharing an AF_ALG socket in the Linux kernel. The flaw, present since about 2011 and analyzed on kernel 6.12.44, lets an unprivileged user become root and can escape a Docker container to root on the host. It was responsibly disclosed and earned a $113,337 Google kernelCTF reward. The author distinguishes it from the later Copy Fail AEAD logic bug, which also uses AF_ALG.

Lobsters · securitySep 26, 19:29 UTC · 14h agoVulnerability 6 sources CVE-2025-39964

14-Year-Old Linux Kernel Flaw Lets Local Users Gain Root Access and Escape Containers

Linux kernel bug CVE-2025-39964 gives local users root and can escape Docker; CISA reports exploitation.

CVE-2025-39964 is a race condition in the Linux kernel AF_ALG cryptographic socket path, introduced in Linux 2.6.38 in 2011, that an unprivileged local process can use to gain root. STAR Labs researchers showed a proof of concept that also escaped a Docker container to the host because containers share the kernel, and Google’s kernelCTF reportedly paid $113,337. CISA has listed the CVE among vulnerabilities exploited in the wild. Upstream fixes add exclusive write ownership; patched stable lines cited include 5.10.246, 5.15.195, 6.1.155, 6.6.109, 6.12.50, and 6.16.10.

Cyber Security Newsupdated Sep 26, 19:29 UTC · 14h agofirst Sep 25, 17:56 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2025-39964

14-Year-Old Linux Kernel Vulnerability Enables Root Access and Docker Escape

Linux kernel flaw CVE-2025-39964 enables local root and Docker escape and is listed in CISA's KEV catalog.

CVE-2025-39964 is a race condition in the Linux kernel AF_ALG interface that has existed since Linux 2.6.38 in 2011 and was fixed in 2025. An unprivileged local attacker can turn an out-of-bounds access during concurrent socket writes into a kernel write, overwrite core_pattern, and execute code as root; researchers also used it to escape a Docker container because containers share the host kernel. STAR Labs researcher Muhammad Alifa Ramdhan and Bing-Jhong Billy Jheng received $113,337 from Google for the chain. Fixed stable versions include 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, and 6.16.9, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 18, 2026.

GBHackersupdated Sep 26, 19:29 UTC · 14h agofirst Sep 25, 12:48 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2025-39964

Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws

Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.

Google released Chrome 154 to the Stable channel, fixing 108 security vulnerabilities including 11 critical flaws. The critical bugs involve memory-safety issues in the ANGLE, GPU, and WebGL components, which could allow code execution or sandbox escapes. Organizations should prioritize deployment as exploit details may remain restricted until patches are widely adopted.

GBHackersSep 23, 09:02 UTC · 4d agoVulnerability CVE-2026-95350 CVE-2026-95357 CVE-2026-95339+8 CVEs

WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

WordPress 7.1.2 fixes a critical unauthenticated path traversal flaw (CVE-2026-87902) that could allow remote code execution.

WordPress released version 7.1.2 to address a critical unauthenticated path traversal vulnerability (CVE-2026-87902). The flaw allows an attacker to load and execute arbitrary PHP files from outside the site's active theme folders, potentially leading to remote code execution. All WordPress versions from 4.7.0 through 7.1.1 are affected, and users should update immediately.

Help Net Securityupdated Sep 26, 07:42 UTC · 1d agofirst Sep 23, 09:01 UTC · 4d agoVulnerability 16 sources CVE-2026-87902

CISA alerts of active exploitation of three Linux kernel flaws

CISA says three Linux kernel flaws, one critical, are actively exploited and due for federal fixes today.

CISA warned that three Linux kernel vulnerabilities are being exploited and ordered federal agencies to patch and mitigate by the end of September 21, 2026, with forensic triage required. Severities range from medium to critical. CVE-2025-39964 is a 14-year-old AF_ALG race condition that STAR Labs used for privilege escalation and container escape in Google's kernelCTF. CVE-2026-53266 is an ebtables SNAT out-of-bounds write, and CVE-2025-39682 is a kTLS receive-path flaw; Red Hat says public exploits exist for both. CISA has not named actors, and none is flagged as ransomware use.

BleepingComputerupdated Sep 26, 19:29 UTC · 14h agofirst Sep 21, 20:12 UTC · 5d agoExploit / PoC in the wild 6 sources CVE-2025-39964 CVE-2026-53266

China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor

China-linked UNC3569 exploited a Sogou Input Method flaw to deploy GRAYRABBIT backdoor on Windows machines across East and Southeast Asia.

Gen Digital found that China-linked UNC3569, a hacker-for-hire group tracked by Google since 2021, exploited a flaw in Sogou Input Method's Windows sgbiz: link handler to reach a sandbox-disabled Chromium 80 build and exploit 2021's CVE-2021-38003 for code execution. The chain delivered GRAYRABBIT, a remote shell backdoor capable of file transfer and module loading, via a 7-Zip DLL sideloading trick gated on process count. Tencent fixed the handler flaw in April 2026 but the embedded browser remains outdated. Sogou has over 455 million monthly users and roughly 70% share of Chinese input methods.

The Hacker NewsSep 11, 07:14 UTC · 16d agoThreat actor in the wildCVE-2021-38003

STAR Labs

Timeline7 articles

Related CVEsby mentions

Appears with