How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
Researcher details CVE-2025-39964, an AF_ALG race that gave unprivileged Linux users root and a $113,337 kernelCTF prize.
Muhammad Alifa Ramdhan, with Bing-Jhong Billy Jheng at STAR Labs, describes finding CVE-2025-39964, a race between writers sharing an AF_ALG socket in the Linux kernel. The flaw, present since about 2011 and analyzed on kernel 6.12.44, lets an unprivileged user become root and can escape a Docker container to root on the host. It was responsibly disclosed and earned a $113,337 Google kernelCTF reward. The author distinguishes it from the later Copy Fail AEAD logic bug, which also uses AF_ALG.
64