14-Year-Old Linux Kernel Flaw Lets Local Users Gain Root Access and Escape Containers
Linux kernel bug CVE-2025-39964 gives local users root and can escape Docker; CISA reports exploitation.
CVE-2025-39964 is a race condition in the Linux kernel AF_ALG cryptographic socket path, introduced in Linux 2.6.38 in 2011, that an unprivileged local process can use to gain root. STAR Labs researchers showed a proof of concept that also escaped a Docker container to the host because containers share the kernel, and Google’s kernelCTF reportedly paid $113,337. CISA has listed the CVE among vulnerabilities exploited in the wild. Upstream fixes add exclusive write ownership; patched stable lines cited include 5.10.246, 5.15.195, 6.1.155, 6.6.109, 6.12.50, and 6.16.10.
- CVE-2025-39964 is a race in the Linux AF_ALG sendmsg path.
- A local user can gain root and escape Docker on affected hosts.
- CISA lists the flaw among vulnerabilities exploited in the wild.
- Fixes include kernels 5.10.246, 5.15.195, 6.1.155, 6.6.109, 6.12.50, and 6.16.10.
- Google kernelCTF reportedly paid a $113,337 bounty.
- CVEs
- CVE-2025-39964
- Products
- Linux kernelDocker
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-39964 | Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg) | 5.5 | 2% | KEV | KEV |
From the original article
2 min read at cybersecuritynews.com
A 14-year-old Linux kernel vulnerability can let a local attacker escalate to root privileges and, in a proof-of-concept environment, escape a Docker container to compromise the underlying host. The flaw in Linux’s AF_ALG userspace cryptographic interface stems from unsafe concurrent writes to the same socket used for operations like AES encryption and decryption. Because an […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.