Linux Kernel AF_ALG Socket Race Condition (CVE-2025-39964)

Catalog analysis: CISA added this entry on September 18, 2026. The entry reflects catalog information retrieved on September 18, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2025-39964 is a race condition (CWE-362) within the Linux kernel. The flaw exists in the AF_ALG socket implementation, where concurrent write operations to the same socket can result in data being unpredictably interleaved. This behavior creates inconsistencies in the internal state of the socket.

Exposure and applicability

This vulnerability affects systems running versions of the Linux kernel that utilize the AF_ALG socket interface without the necessary concurrency protections. Because this is an open-source component, exposure extends across various distributions and proprietary implementations that incorporate the affected kernel code.

Infrastructure owners should prioritize assets with high internet exposure or those running multi-threaded applications that interact with AF_ALG sockets. CISA has categorized this as a Known Exploited Vulnerability (KEV), indicating active exploitation in the wild.

Remediation priorities

Remediation focuses on updating the kernel to a version containing the fix for the race condition. Our analysis suggests the following prioritization:

1. Identify Affected Kernels: Inventory all Linux assets and determine if they are running versions susceptible to this AF_ALG flaw.
2. Apply Kernel Patches: Deploy updates based on the specific stable git commits provided by kernel.org (e.g., commits 0f28c4ad, e4c1ec11, 1f323a48, 7c4491b5, 9aee87da, 45bcf60f, and 1b34cbbf).
3. Verify Distribution Backports: For those using managed distributions (e.g., RHEL, Ubuntu, Debian), verify that the vendor has backported these specific fixes into the distribution’s kernel release.

How to validate remediation

To ensure exposure is reduced, defenders should move beyond simple version checks:

• Commit Verification: For custom or mainline kernels, verify that the specific git commits listed in the vulnerability notes are present in the build history.
• Kernel Runtime Check: Confirm that the running kernel version matches the patched version after a reboot; a package update alone does not mitigate the risk until the new kernel is loaded into memory.
• Configuration Audit: Identify if AF_ALG sockets are being utilized by critical applications to determine if the attack surface can be further reduced via configuration changes while patching is underway.

Limits and open questions

Applying a patch reduces the likelihood of this specific race condition but does not guarantee immunity from other concurrency flaws within the kernel. There remains uncertainty regarding whether this vulnerability has been utilized in ransomware campaigns, as current data lists this status as unknown. Additionally, because AF_ALG is an open-source component used across diverse products, the exact impact may vary depending on how a specific vendor has implemented or modified the kernel.

Source and editorial note

CVE-2025-39964: Linux Kernel Race Condition Vulnerability · Source date: September 18, 2026 · Retrieved September 18, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment