CISA Adds Linux Kernel AF_ALG Race Condition to KEV Catalog

TL;DR

• CISA added CVE-2025-39964 to its catalog following active exploitation of a race condition in the Linux kernel's AF_ALG socket interface [^1][^2].
• The flaw allows concurrent write operations to corrupt kernel socket states, potentially leading to local privilege escalation or system crashes [^1].

Background

The Linux kernel provides a dedicated socket interface called AF_ALG to allow user-space applications to access the kernel's internal cryptography framework. Instead of implementing cryptographic algorithms like AES or SHA inside application memory, programs send raw data to an AF_ALG socket. The kernel processes the mathematical operations using optimized hardware drivers and returns the result. Because this boundary crosses from user space to kernel space, any processing errors can compromise the entire operating system's security.

What happened

Federal security officials added CVE-2025-39964 to the Known Exploited Vulnerabilities catalog, confirming that attackers are actively targeting a race condition within the Linux kernel [^1][^2]. The vulnerability resides within the subsystem that manages concurrent write operations to active AF_ALG sockets [^1]. When multiple threads of execution attempt to write data to the same socket simultaneously, the kernel fails to serialize the requests properly, causing data payloads to interleave unpredictably [^1].

This interleaving corrupts the internal state machine of the socket [^1]. Sockets rely on strict state transitions to track memory buffers, cryptographic keys, and execution contexts. When concurrent writes bypass the kernel's synchronization locks, the socket's internal pointers point to invalid or overlapping memory regions [^1]. This state confusion violates basic memory safety assumptions and can result in use-after-free conditions or buffer overflows within the kernel heap [^1].

Because the vulnerability occurs within the kernel space, the resulting memory corruption is highly dangerous [^1]. An attacker with local, non-privileged access to a system can spawn multiple threads to trigger this race condition repeatedly. By carefully timing the concurrent write operations, the attacker can force the kernel to write user-controlled data into privileged system memory regions, bypassing the operating system's built-in access controls [^1][^2].

The complexity of the AF_ALG interface exacerbates the issue [^1]. Because the interface must support a wide variety of cryptographic algorithms, its state-tracking logic is highly intricate. The kernel must allocate memory dynamically based on the specific algorithm requested by the user [^1]. When the race condition is triggered, these dynamic allocations become misaligned, allowing an attacker to corrupt adjacent kernel structures [^1].

Why it matters

Race conditions in core operating system kernels are notoriously difficult to detect but highly valuable to attackers. Traditional security scanners focus on static code analysis or signature-based detection, both of which struggle to identify transient timing flaws. An AF_ALG race condition allows a local attacker to escalate their privileges from a standard, restricted user account to root access. Once root access is achieved, the attacker gains complete control over the physical or virtual machine, allowing them to install persistent malware, disable logging, or pivot to other systems on the network.

This vulnerability also highlights a fundamental challenge in modern operating system design: balancing performance with security. Offloading cryptographic tasks to the kernel reduces context-switching overhead, but it introduces a massive attack surface. When a vulnerability is discovered in a user-space cryptography library, only the applications using that library are affected. However, a vulnerability in a kernel-level socket interface like AF_ALG threatens the integrity of the entire system, regardless of which applications are running.

The active exploitation of CVE-2025-39964 emphasizes the ongoing risk associated with legacy kernel interfaces. While AF_ALG offers performance benefits for specific cryptographic operations, it also exposes a complex API to untrusted user-space applications. For enterprise environments, especially those hosting multi-tenant cloud infrastructure or shared containers, this vulnerability poses a severe threat. A single compromised container could exploit this flaw to escape its sandbox and compromise the host machine. System administrators must prioritize kernel updates across all deployed Linux distributions to mitigate this active threat.

Practical example

Imagine a shared corporate server where an employee named Sarah has a basic user account. She wants to access restricted payroll databases, but her account lacks the required permissions.

Sarah runs a small program that opens an AF_ALG socket to encrypt some text. Her program starts two execution threads that write to the same socket at the exact same millisecond.

Normally, the kernel forces one thread to wait. Because of the race condition, both threads write simultaneously. The kernel mixes their data, confusing the socket's memory tracker.

The socket's tracker accidentally points to a privileged kernel memory block instead of Sarah's temporary buffer. Her program writes a new permission token directly into that kernel memory. Instantly, Sarah's basic user account gains administrator rights, allowing her to view the restricted payroll database.

Related gear

We recommend this handbook because it offers an exhaustive guide to Linux system calls, socket programming, and memory management interfaces.