CVE-2025-39964: Linux kernel af_alg race condition allows concurrent socket writes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityLocal low-privilege race condition with only denial-of-service impact, but it is in CISA KEV with a near-term remediation due date, raising urgency above its medium CVSS score.

What it is

The Linux kernel's af_alg crypto socket implementation did not prevent two concurrent writes to the same socket, allowing data to be interleaved unpredictably and corrupting internal socket state. The fix adds a ctx->write field that grants exclusive write ownership. It matters because it is a local race condition that can crash or destabilize the kernel, and it is listed in CISA KEV.

Impact

An attacker with local access can trigger a race condition that corrupts af_alg socket state, causing a denial of service (kernel crash or hang). There is no confidentiality or integrity impact per the CVSS vector.

Attack surface

Reached locally by issuing concurrent write operations to the same af_alg socket; the CVSS vector is AV:L/AC:L/PR:L/UI:N, so it requires local access and low privileges but no user interaction. No remote or network vector is described.

Exploitation

CISA added it to KEV with a due date of 2026-09-21, indicating known exploitation, while EPSS is low (0.00323, 25th percentile) and no ransomware use is documented. All references are patches or advisories, with no public exploit tagged.

What to do

• Apply the upstream kernel patches from the git.kernel.org stable references (or your distribution's backport) as the first action.
• For Siemens SIMATIC S7-1500 CPU 1518-4 and 1518F-4 PN/DP MFP firmware, follow Siemens advisory SSA-019113 for fixed firmware versions.
• Where patching is not yet possible, restrict local shell and process access on affected hosts to trusted users to reduce the local attack surface.
• Track CISA BOD 26-04 requirements and the KEV due date of 2026-09-21 for remediation tracking.
• Monitor for kernel crashes or oopses in the crypto/af_alg path as an interim indicator.

Detection

• Monitor kernel logs (dmesg/journal) for oopses, warnings or panics referencing af_alg, algif or crypto socket code.
• Alert on unexpected process crashes or reboots on hosts that use AF_ALG sockets (for example, OpenSSL afalg engine users).
• Audit for unusual concurrent write patterns to AF_ALG sockets via eBPF or auditd syscall tracing where feasible.
• Verify patch state by checking kernel version against the fixed stable releases referenced in the advisories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.