How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
Researcher details CVE-2025-39964, an AF_ALG race that gave unprivileged Linux users root and a $113,337 kernelCTF prize.
Muhammad Alifa Ramdhan, with Bing-Jhong Billy Jheng at STAR Labs, describes finding CVE-2025-39964, a race between writers sharing an AF_ALG socket in the Linux kernel. The flaw, present since about 2011 and analyzed on kernel 6.12.44, lets an unprivileged user become root and can escape a Docker container to root on the host. It was responsibly disclosed and earned a $113,337 Google kernelCTF reward. The author distinguishes it from the later Copy Fail AEAD logic bug, which also uses AF_ALG.
- CVE-2025-39964 is a race between writers on one AF_ALG socket.
- Unprivileged socket API access can become root on the host.
- The same bug can escape Docker to root on the host.
- Present since about 2011; analyzed on Linux kernel 6.12.44.
- Responsibly disclosed; Google kernelCTF reward was $113,337.
- CVEs
- CVE-2025-39964
- Products
- Linux kernelAF_ALGDocker
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-39964 | Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg) | 5.5 | 2% | KEV | KEV |
From the original article
14 min read at idnsec.com
In 2025, I found an AF_ALG vulnerability in the Linux kernel that allowed an ordinary user to escalate privileges to root. This is a retrospective on how I found CVE-2025-39964 and how we developed the exploit, before Copy Fail drew wider attention to AF_ALG in 2026. Editorial (IDNSEC): Muhammad Alifa Ramdhan discovered CVE-2025-39964 while conducting research at STAR Labs.
By idnsec.com via fro · idnsec.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.