CVE-2025-39964

Published Oct 13, 2025

Last updated a day ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-39964 describes a race condition vulnerability found within the Linux kernel's cryptographic user API, specifically affecting the `AF_ALG` component. This flaw arises from the way concurrent write operations to the same `AF_ALG` socket are managed. The vulnerability can lead to unpredictable interleaving of data and inconsistencies in the internal state of the socket. To address this, a fix was implemented that introduces an exclusive write ownership mechanism (`ctx->write`), ensuring that only one writer can issue `sendmsg()` at a time and preventing state corruption.

Description: In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Analyzed
Products: linux_kernel, simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware, simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.5
Impact score: 3.6
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Severity: MEDIUM

Known exploits

Data from CISA

Vulnerability name: Linux Kernel Race Condition Vulnerability
Exploit added on: Sep 18, 2026
Exploit action due: Sep 21, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

nvd@nist.gov: CWE-362
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-362

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 18

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "EC314BAD-D810-4C02-ABB3-11D90E06AEAA",
            "versionEndExcluding": "5.10.245",
            "versionStartIncluding": "2.6.38",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "CF862263-DC8D-4324-A52A-DA1D7880B35A",
            "versionEndExcluding": "5.15.194",
            "versionStartIncluding": "5.11",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "E49CD91E-FC55-45B0-BB63-9AD5F5D70CAA",
            "versionEndExcluding": "6.1.154",
            "versionStartIncluding": "5.16",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "A7E8EAEE-7731-4996-9578-696255D61EA2",
            "versionEndExcluding": "6.6.108",
            "versionStartIncluding": "6.2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "CAA033E9-A2C5-4976-A83E-9804D8FB827F",
            "versionEndExcluding": "6.12.49",
            "versionStartIncluding": "6.7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "638DD910-1189-4F5E-98BF-2D436B695112",
            "versionEndExcluding": "6.16.9",
            "versionStartIncluding": "6.13",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*",
            "matchCriteriaId": "327D22EF-390B-454C-BD31-2ED23C998A1C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*",
            "matchCriteriaId": "C730CD9A-D969-4A8E-9522-162AAF7C0EE9",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc3:*:*:*:*:*:*",
            "matchCriteriaId": "39982C4B-716E-4B2F-8196-FA301F47807D",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc4:*:*:*:*:*:*",
            "matchCriteriaId": "340BEEA9-D70D-4290-B502-FBB1032353B1",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc5:*:*:*:*:*:*",
            "matchCriteriaId": "47E4C5C0-079F-4838-971B-8C503D48FCC2",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:rc6:*:*:*:*:*:*",
            "matchCriteriaId": "5A4516A6-C12E-42A4-8C0E-68AEF3264504",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518-4_pn\\/dp_mfp_firmware:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "421F0D66-BEED-4A31-801A-D4414D790123",
            "versionStartIncluding": "3.1.6",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518-4_pn\\/dp_mfp:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "7F223390-56E5-4F1F-A4BE-E96003F7BDC3",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:siemens:simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp_firmware:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "1B9AA936-AF22-46C2-B6BC-0DD8FD6A0309",
            "versionStartIncluding": "3.1.6",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:siemens:simatic_s7-1500_cpu_1518f-4_pn\\/dp_mfp:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "6DD481CC-4EC9-4248-943E-3AD5F79277B2",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.