CVE-2025-39964 Linux Kernel Race Condition
Concurrent writes to an af_alg socket can cause data interleaving and internal state inconsistencies, potentially leading to data corruption or denial of service.
- Exploited in the wild
- Since 18 Sep 2026
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39964?
CVE-2025-39964 is a high-severity vulnerability in Linux kernel, published on 13 Oct 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state.
Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.
Weakness: CWE-362
Which versions are affected by CVE-2025-39964?
It affects 3 products.
Products include Linux kernel, Siemens Simatic S7-1500 Cpu 1518-4 Pn\/Dp Mfp Firmware, Siemens Simatic S7-1500 Cpu 1518f-4 Pn\/Dp Mfp Firmware.
How do I fix CVE-2025-39964?
Apply the vendor's patch. US federal agencies must fix it by 21 Sep 2026.
Is CVE-2025-39964 being exploited?
Yes. Attackers have exploited CVE-2025-39964 in the wild since at least 18 Sep 2026.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-68460, AZL-76437, BELL-CVE-2025-39964, DEBIAN-CVE-2025-39964, GHSA-wr5g-mfhw-rpfj, ROOT-OS-DEBIAN-11-CVE-2025-39964 and 5 more.