ZeroDayAlert

CVE-2025-39964: Linux Kernel Race Condition Vulnerability

Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.

Linux Kernel Added to KEV 2026-09-18 Federal due 2026-09-21 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

This vulnerability affects systems running the Linux kernel. The flaw is a race condition in the AF_ALG socket interface, which handles cryptographic operations. Any Linux system with active AF_ALG socket usage—whether directly by user-space cryptographic applications or indirectly through kernel subsystems—is potentially vulnerable if concurrent writes occur to the same socket.

How to check whether this touches you

  • Inventory whether your systems run Linux, and note the kernel versions in use across your estate.
  • Establish whether AF_ALG sockets are active: check application and service configurations that use kernel-space cryptographic acceleration (inspect running processes and listening sockets using ss, netstat, or lsof for AF_ALG activity).
  • Determine whether your deployment architecture permits multiple concurrent writers to the same AF_ALG socket—this is the condition required for exploitation; isolated single-writer use cases carry lower risk.
  • Obtain the exact kernel version from uname -r and cross-reference against Linux vendor security advisories to confirm whether your version is affected and whether a patch is available.
  • Monitor your kernel source or vendor patch notes for backported fixes, as some distributions release security fixes for older kernel versions.

What to do

  1. Consult your Linux vendor's security advisory for this CVE to determine the patched kernel version and your upgrade path.
  2. If you cannot patch immediately, audit your environment to identify and isolate services that use AF_ALG sockets; discontinue or restrict their use until patching is complete.
  3. If the vulnerability affects a critical system, establish firewall or network segmentation rules to limit access to any services that depend on AF_ALG functionality to trusted internal networks only.
  4. Enable kernel and application logging to capture any anomalies in cryptographic operation results or socket state errors; retain these logs for at least 90 days.
  5. Plan patching according to CISA BOD 26-04 timelines: federal systems have until 2026-09-21 to apply mitigations or discontinue use.
  6. For cloud-hosted systems, verify with your cloud provider whether patches have been applied to the underlying kernel, and schedule maintenance windows to reboot instances if necessary.

If you find you were exposed

Exploitation of a race condition typically occurs during normal operation and may leave inconsistent cryptographic results rather than obvious breach artifacts. Review application logs and cryptographic operation records dating back to your kernel deployment date, looking for failed operations, mismatched checksums, or corrupted encrypted data. If AF_ALG sockets processed sensitive cryptographic material, assume that interleaved data could have been observable to an attacker with sufficient system access; evaluate whether key material or plaintext was at risk and consider key rotation if warranted. Log retention is usually your limiting factor, so prioritise preservation of any audit logs covering the affected period.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2025-39964 is being exploited. It cannot tell you whether Kernel is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →