CVE-2025-39964: Linux Kernel Race Condition Vulnerability
Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
Overview
A race condition in the Linux kernel's AF_ALG (crypto socket) subsystem allows a local user to trigger concurrent writes to the same socket, corrupting the socket's internal state. Affected kernels range from 2.6.38 through the fixed stable releases. Siemens SIMATIC S7-1500 MFP firmware at version 3.1.6 is also listed as affected. At minimum, an attacker can cause a denial of service; a secondary assessment suggests the corrupted cryptographic state may also affect confidentiality and integrity.
Vulnerability details
The AF_ALG socket interface exposes kernel cryptographic operations to user space via standard socket calls. Before the fix, the sendmsg handler in af_alg_sendmsg had no mutual exclusion guard: two threads sharing the same socket file descriptor could both enter the write path simultaneously. The resulting race corrupts the scatter-gather list and the boolean context fields (more, merge, enc, init) that track operation state. The fix adds a ctx->write flag that returns -EBUSY to any second caller until the first write completes, enforcing exclusive ownership.
An attacker with a local, low-privileged account opens an AF_ALG socket and spawns two threads that both call sendmsg concurrently on the same file descriptor. The race produces unpredictably interleaved data and inconsistent socket state, causing at minimum a kernel-level denial of service. A secondary CNA assessment scores this C:H/I:H/A:H, suggesting the corrupted cryptographic context may be exploitable beyond availability impact, though the precise path to confidentiality or integrity compromise is not described in the available facts. No network access is required.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor for kernel error returns of EBUSY (-16) from the af_alg sendmsg path on patched kernels; on unpatched kernels, watch for unexpected kernel panics or oops traces referencing af_alg_sendmsg or crypto/af_alg.c in system logs such as /var/log/kern.log or the kernel ring buffer (dmesg).
- Audit processes opening AF_ALG sockets (socket family AF_ALG, type SOCK_SEQPACKET) from non-root accounts; a single process spawning multiple threads that share one AF_ALG file descriptor and issue concurrent sendmsg calls is anomalous and warrants investigation.
Remediation
Additional hardening
- Update the Linux kernel to 5.10.245 or later in the 5.10 stable series, 5.15.194 or later in the 5.15 series, 6.1.154 or later in the 6.1 series, or 6.6.108 or later in the 6.6 series; see References for additional stable-branch boundaries.
- Restrict access to AF_ALG sockets by applying seccomp profiles or LSM (AppArmor/SELinux) policies that deny the socket(AF_ALG) call for workloads that do not require user-space cryptographic operations.
- For Siemens SIMATIC S7-1500 MFP devices, follow Siemens advisory SSA-019113: limit interactive shell access to the GNU/Linux subsystem to trusted personnel only and build or run only applications from trusted sources.
- Apply network segmentation to limit local login access to affected systems, reducing the pool of users who can open sockets and spawn threads against the vulnerable interface.
Key dates
References
- https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce
- https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285
- https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8
- https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042
- https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84
- https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d
- https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2025-39964
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
Frequently asked questions
Does CVE-2025-39964 affect my FedRAMP authorization?
If Linux Kernel runs inside your authorization boundary, yes. CVE-2025-39964 appears in CISA's Known Exploited Vulnerabilities (KEV) catalog, carrying a remediation deadline of September 21, 2026. For a Federal Risk and Authorization Management Program (FedRAMP)-authorized service, an unpatched KEV within the boundary is an assessor finding. You must either remediate it or formally document a mitigation before your assessor and sponsoring agency raise it during review.
How does Knox help me handle CVE-2025-39964?
Knox does not patch your software. Remediating Linux Kernel is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage to help you document the fix for your next assessment. The remediation work is yours to carry out; maintaining a compliant posture while you do it is not something you manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues, including CVE-2025-39964. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you the lead time to act before a finding becomes a formal conversation with your agency.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
What happens if CVE-2025-39964 isn't remediated by September 21, 2026?
An unremediated CVE-2025-39964 becomes a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the item out and documenting the remediation is what keeps your authorization standing and the agency relationship clean.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
