Linux Kernel High Severity Flaw (CVE-2025-39964)

Actively exploited in the wild - CVE-2025-39964 is a high-severity local privilege escalation in the Linux kernel crypto AF_ALG socket interface that lets a low-privileged local user corrupt kernel socket state and escalate privileges. Kernel fixes are shipping across major distributions; update your kernel package immediately.

Overview

The Linux kernel crypto subsystem exposes AF_ALG, a socket family that lets userspace programs hand data to kernel crypto implementations and read the results back. The bug lives in af_alg_sendmsg, the function that handles writes into an AF_ALG socket. Two concurrent writes to the same socket interleave their data unpredictably and corrupt the socket’s internal state. The upstream fix adds a ctx->write ownership field so only one writer can own the socket at a time; a second concurrent writer is rejected outright.

That state corruption matters because AF_ALG objects live in kernel memory and are reachable from any unprivileged process on the host. The CVSS vector (7.8, LOCAL / LOW / LOW / NONE) reflects the reality of this class: an attacker who already has a foothold, a container escape primitive, or a malicious local user can race the socket, corrupt kernel structures, and climb to root. No email click, no network exposure, no user interaction.

Impact

On affected kernels, a local attacker can:

• Corrupt AF_ALG socket state and read or write memory the process should not reach.
• Escalate from an unprivileged account to root, or break out of a container that shares the host kernel.
• Destabilize the crypto layer, causing crashes or silent data corruption in workloads that rely on AF_ALG (AF_ALG is used by OpenSSL’s afalg engine, some VPN stacks, and certain offload paths).

Because CISA has added CVE-2025-39964 to the Known Exploited Vulnerabilities catalog, treat any unpatched host as compromised-adjacent, not merely at risk.

Remediation

1. Patch the kernel. Update to the fixed build for your distribution (RHEL, Ubuntu, Debian, SUSE, and mainline all carry the ctx->write fix). Reboot into the new kernel; a package install alone does not load it.
2. Verify the running kernel, not just the installed one: uname -r after reboot.
3. Mitigate if you cannot reboot now. Block AF_ALG for untrusted local users with crypto_user/AF_ALG restrictions, or run workloads in hardened sandboxes that deny socket(AF_ALG, ...). This is a stopgap, not a fix.
4. Audit container hosts. On multi-tenant Kubernetes nodes, an unpatched host kernel is a shared-blast-radius problem.

Security Insight

CVE-2025-39964 is the third Linux kernel privilege escalation to hit CISA’s KEV catalog this cycle, following the root-access bug tracked as CVE-2026-31 and the CrackArmor AppArmor bypasses. The pattern is clear: kernel crypto and LSM subsystems, long treated as hardened plumbing, are now the attacker’s favorite local escalation surface because a single foothold anywhere on the host converts into root everywhere. Teams that postpone kernel reboots are not deferring a maintenance task; they are leaving confirmed exploitation paths open on every host in the fleet, as this week’s threat roundup makes plain.

Further Reading

• CISA Adds Actively Exploited Linux Root Bug CVE-2026-31
• Weekly Threat Roundup: Apache & cPanel Zero-Days (Apr 27 - May 3)
• Nine CrackArmor Flaws in Linux AppArmor Enable Root
• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs