14-Year-Old Linux Kernel Vulnerability Enables Root Access and Docker Escape
Linux kernel flaw CVE-2025-39964 enables local root and Docker escape and is listed in CISA's KEV catalog.
CVE-2025-39964 is a race condition in the Linux kernel AF_ALG interface that has existed since Linux 2.6.38 in 2011 and was fixed in 2025. An unprivileged local attacker can turn an out-of-bounds access during concurrent socket writes into a kernel write, overwrite core_pattern, and execute code as root; researchers also used it to escape a Docker container because containers share the host kernel. STAR Labs researcher Muhammad Alifa Ramdhan and Bing-Jhong Billy Jheng received $113,337 from Google for the chain. Fixed stable versions include 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, and 6.16.9, and CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 18, 2026.
- A local race in af_alg_sendmsg can yield root.
- Shared kernel access enabled a tested Docker container escape.
- Fixed kernels include 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, and 6.16.9.
- CISA added CVE-2025-39964 to the KEV catalog on September 18, 2026.
- CVEs
- CVE-2025-39964
- Products
- Linux kernelDocker
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-39964 | Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg) | 5.5 | 2% | KEV | KEV |
From the original article
3 min read at gbhackers.com
A vulnerability in the Linux kernel’s AF_ALG cryptographic interface, which has existed for 14 years, can let an unprivileged local attacker gain root access and escape a Docker container by exploiting a race condition in concurrent socket writes. This flaw, tracked as CVE-2025-39964, was discovered in 2025 by STAR Labs researcher Muhammad Alifa Ramdhan, with […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.