CVE-2025-39964 (GCVE-0-2025-39964)

Vulnerability from cvelistv5 – Published: 2025-10-13 13:48 – Updated: 2026-09-19 03:56
VLAI
Title
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: active Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 00:00 UTC
CWE
  • CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 , < 0f28c4adbc4a97437874c9b669fd7958a8c6d6ce (git)
Affected: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 , < e4c1ec11132ec466f7362a95f36a506ce4dc08c9 (git)
Affected: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 , < 1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8 (git)
Affected: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 , < 7c4491b5644e3a3708f3dbd7591be0a570135b84 (git)
Affected: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 , < 9aee87da5572b3a14075f501752e209801160d3d (git)
Affected: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 , < 45bcf60fe49b37daab1acee57b27211ad1574042 (git)
Affected: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 , < 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 (git)
Create a notification for this product.
Linux Linux Affected: 2.6.38
Unaffected: 0 , < 2.6.38 (semver)
Unaffected: 5.10.245 , ≤ 5.10.* (semver)
Unaffected: 5.15.194 , ≤ 5.15.* (semver)
Unaffected: 6.1.154 , ≤ 6.1.* (semver)
Unaffected: 6.6.108 , ≤ 6.6.* (semver)
Unaffected: 6.12.49 , ≤ 6.12.* (semver)
Unaffected: 6.16.9 , ≤ 6.16.* (semver)
Unaffected: 6.17 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-39964",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-09-18",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-362",
                "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-19T03:56:17.769Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-09-18T00:00:00.000Z",
            "value": "CVE-2025-39964 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T08:42:37.537Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "crypto/af_alg.c",
            "include/crypto/if_alg.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f28c4adbc4a97437874c9b669fd7958a8c6d6ce",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            },
            {
              "lessThan": "e4c1ec11132ec466f7362a95f36a506ce4dc08c9",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            },
            {
              "lessThan": "1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            },
            {
              "lessThan": "7c4491b5644e3a3708f3dbd7591be0a570135b84",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            },
            {
              "lessThan": "9aee87da5572b3a14075f501752e209801160d3d",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            },
            {
              "lessThan": "45bcf60fe49b37daab1acee57b27211ad1574042",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            },
            {
              "lessThan": "1b34cbbf4f011a121ef7b2d7d6e6920a036d5285",
              "status": "affected",
              "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "crypto/af_alg.c",
            "include/crypto/if_alg.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.38"
            },
            {
              "lessThan": "2.6.38",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.245",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.194",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.154",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.108",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.16.*",
              "status": "unaffected",
              "version": "6.16.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.245",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.194",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.154",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.108",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.49",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.16.9",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.17",
                  "versionStartIncluding": "2.6.38",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion.  Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx-\u003ewrite field that indiciates\nexclusive ownership for writing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached through the AF_ALG socket family via `socket()`/`bind()`/`sendmsg()`/`recvmsg()` syscalls, which requires local system access. There is no remote or adjacent-network path to `af_alg_sendmsg()`.\nAC:L - The attacker controls both sides of the race entirely \u2014 two of its own threads on a socket it owns \u2014 and can force writer A to park deterministically in `af_alg_wait_for_wmem()` by sizing `SO_SNDBUF` and filling it, then wake it on demand with its own `recvmsg()`. The error exit that leaves `cur == 0` is triggered at will with a deliberately faulting user buffer, so no condition is outside the attacker\u0027s control.\nPR:L - `alg_create()`, `alg_bind()` and `alg_setkey()` perform no capability checks whatsoever, so any unprivileged local user \u2014 including one inside a container or unprivileged user namespace \u2014 can open, bind and write to an AF_ALG skcipher/aead socket. The required modules are auto-loaded on demand via `MODULE_ALIAS_NETPROTO(AF_ALG)` and `request_module(\"algif-%s\")`.\nUI:N - The attacking process performs every step itself \u2014 socket creation, bind, and the two concurrent `sendmsg()` calls. No victim action or interaction of any kind is needed.\nS:U - The corruption is confined to kernel heap objects (`struct af_alg_tsgl`/scatterlist and adjacent slab memory) within the same security authority. No hypervisor, IOMMU, or other trust boundary is crossed.\nC:H - The out-of-bounds scatterlist entry is fabricated from kernel list pointers and is subsequently handed to the cipher by `skcipher_recvmsg`/`aead_recvmsg` via `af_alg_pull_tsgl()`, so arbitrary kernel memory is encrypted/decrypted and returned to userspace. This yields a kernel memory disclosure primitive, not merely a pointer leak.\nI:H - `memcpy_from_msg(page_address(sg_page(sg)) + sg-\u003eoffset + sg-\u003elength, msg, len)` on the underflowed scatterlist writes attacker-controlled data of attacker-chosen length to an address derived from attacker-influenceable heap contents. Combined with heap grooming of the 4KB tsgl allocations, this is a controlled kernel write suitable for privilege escalation.\nA:H - Dereferencing `page_address(sg_page(sg))` on a bogus page_link, and the later `put_page()` on that fabricated page, reliably produce an oops/panic or page refcount corruption. Any unprivileged user can trigger this repeatedly, crashing the machine."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:06:33.126Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84"
        },
        {
          "url": "https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285"
        }
      ],
      "title": "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-39964",
    "datePublished": "2025-10-13T13:48:30.334Z",
    "dateReserved": "2025-04-16T07:20:57.149Z",
    "dateUpdated": "2026-09-19T03:56:17.769Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-39964",
      "date": "2026-10-03",
      "epss": "0.00996",
      "percentile": "0.61394"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "affected": [
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "V3.1.6",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "V3.1.6",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "V3.1.6",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "V3.1.6",
                    "versionType": "custom"
                  }
                ]
              },
              {
                "defaultStatus": "unknown",
                "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
                "vendor": "Siemens",
                "versions": [
                  {
                    "lessThan": "*",
                    "status": "affected",
                    "version": "V3.1.6",
                    "versionType": "custom"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-08T08:42:37.537Z",
              "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
              "shortName": "siemens-SADP"
            },
            "references": [
              {
                "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
              }
            ],
            "x_adpType": "supplier"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-39964",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-18T14:40:05.718549Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2026-09-18",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964"
                  },
                  "type": "kev"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-362",
                    "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-11T17:35:29.681Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2026-09-18T00:00:00.000Z",
                "value": "CVE-2025-39964 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "crypto/af_alg.c",
                "include/crypto/if_alg.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "0f28c4adbc4a97437874c9b669fd7958a8c6d6ce",
                  "status": "affected",
                  "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
                  "versionType": "git"
                },
                {
                  "lessThan": "e4c1ec11132ec466f7362a95f36a506ce4dc08c9",
                  "status": "affected",
                  "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
                  "versionType": "git"
                },
                {
                  "lessThan": "1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8",
                  "status": "affected",
                  "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
                  "versionType": "git"
                },
                {
                  "lessThan": "7c4491b5644e3a3708f3dbd7591be0a570135b84",
                  "status": "affected",
                  "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
                  "versionType": "git"
                },
                {
                  "lessThan": "9aee87da5572b3a14075f501752e209801160d3d",
                  "status": "affected",
                  "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
                  "versionType": "git"
                },
                {
                  "lessThan": "45bcf60fe49b37daab1acee57b27211ad1574042",
                  "status": "affected",
                  "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
                  "versionType": "git"
                },
                {
                  "lessThan": "1b34cbbf4f011a121ef7b2d7d6e6920a036d5285",
                  "status": "affected",
                  "version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "crypto/af_alg.c",
                "include/crypto/if_alg.h"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "2.6.38"
                },
                {
                  "lessThan": "2.6.38",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.245",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.194",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.154",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.108",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.12.*",
                  "status": "unaffected",
                  "version": "6.12.49",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.16.*",
                  "status": "unaffected",
                  "version": "6.16.9",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.17",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.245",
                      "versionStartIncluding": "2.6.38",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.194",
                      "versionStartIncluding": "2.6.38",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.154",
                      "versionStartIncluding": "2.6.38",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.108",
                      "versionStartIncluding": "2.6.38",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12.49",
                      "versionStartIncluding": "2.6.38",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.16.9",
                      "versionStartIncluding": "2.6.38",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.17",
                      "versionStartIncluding": "2.6.38",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Disallow concurrent writes in af_alg_sendmsg\n\nIssuing two writes to the same af_alg socket is bogus as the\ndata will be interleaved in an unpredictable fashion.  Furthermore,\nconcurrent writes may create inconsistencies in the internal\nsocket state.\n\nDisallow this by adding a new ctx-\u003ewrite field that indiciates\nexclusive ownership for writing."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The vulnerability is reached through the AF_ALG socket family via `socket()`/`bind()`/`sendmsg()`/`recvmsg()` syscalls, which requires local system access. There is no remote or adjacent-network path to `af_alg_sendmsg()`.\nAC:L - The attacker controls both sides of the race entirely \u2014 two of its own threads on a socket it owns \u2014 and can force writer A to park deterministically in `af_alg_wait_for_wmem()` by sizing `SO_SNDBUF` and filling it, then wake it on demand with its own `recvmsg()`. The error exit that leaves `cur == 0` is triggered at will with a deliberately faulting user buffer, so no condition is outside the attacker\u0027s control.\nPR:L - `alg_create()`, `alg_bind()` and `alg_setkey()` perform no capability checks whatsoever, so any unprivileged local user \u2014 including one inside a container or unprivileged user namespace \u2014 can open, bind and write to an AF_ALG skcipher/aead socket. The required modules are auto-loaded on demand via `MODULE_ALIAS_NETPROTO(AF_ALG)` and `request_module(\"algif-%s\")`.\nUI:N - The attacking process performs every step itself \u2014 socket creation, bind, and the two concurrent `sendmsg()` calls. No victim action or interaction of any kind is needed.\nS:U - The corruption is confined to kernel heap objects (`struct af_alg_tsgl`/scatterlist and adjacent slab memory) within the same security authority. No hypervisor, IOMMU, or other trust boundary is crossed.\nC:H - The out-of-bounds scatterlist entry is fabricated from kernel list pointers and is subsequently handed to the cipher by `skcipher_recvmsg`/`aead_recvmsg` via `af_alg_pull_tsgl()`, so arbitrary kernel memory is encrypted/decrypted and returned to userspace. This yields a kernel memory disclosure primitive, not merely a pointer leak.\nI:H - `memcpy_from_msg(page_address(sg_page(sg)) + sg-\u003eoffset + sg-\u003elength, msg, len)` on the underflowed scatterlist writes attacker-controlled data of attacker-chosen length to an address derived from attacker-influenceable heap contents. Combined with heap grooming of the 4KB tsgl allocations, this is a controlled kernel write suitable for privilege escalation.\nA:H - Dereferencing `page_address(sg_page(sg))` on a bogus page_link, and the later `put_page()` on that fabricated page, reliably produce an oops/panic or page refcount corruption. Any unprivileged user can trigger this repeatedly, crashing the machine."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T12:06:33.126Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce"
            },
            {
              "url": "https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9"
            },
            {
              "url": "https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8"
            },
            {
              "url": "https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84"
            },
            {
              "url": "https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d"
            },
            {
              "url": "https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042"
            },
            {
              "url": "https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285"
            }
          ],
          "title": "crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2025-39964",
        "datePublished": "2025-10-13T13:48:30.334Z",
        "dateReserved": "2025-04-16T07:20:57.149Z",
        "dateUpdated": "2026-09-19T03:56:17.769Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.