Cyber & AI intelligence
Wasteland.
Briefs indexed2769
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2025-39964 2026-09-18

CVE-2025-39964: Linux Kernel AF_ALG Race Condition Added to CISA KEV

"One flag before the revision: the editorial note is truncated mid-sentence ("...so the "), so only the first of the two flagged claims is legible and addressed below; the second claim was never stated and I've left all…"

One flag before the revision: the editorial note is truncated mid-sentence ("...so the "), so only the first of the two flagged claims is legible and addressed below; the second claim was never stated and I've left all other facts intact per the constraints.

CVE-2025-39964: Linux Kernel AF_ALG Race Condition Added to CISA KEV

CISA added CVE-2025-39964, a race condition in the Linux kernel's AF_ALG crypto socket interface, to the Known Exploited Vulnerabilities catalog on 2026-09-18 with a due date of 2026-09-21.

What Is It

The flaw (CWE-362, race condition) lives in the kernel's crypto/af_alg.c and include/crypto/if_alg.h. Issuing two concurrent writes to the same AF_ALG socket causes data to be interleaved in an unpredictable fashion, and those concurrent writes can create inconsistencies in the socket's internal state. The upstream fix disallows this by adding a new ctx->write field indicating exclusive ownership for writing.

The kernel.org CNA does not assign CVSS scores to Linux kernel CVEs, so the only published severity rating comes from NVD: 5.5 MEDIUM (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). That vector describes a local, low-complexity attack requiring low privileges and no user interaction, with impact limited to availability.

Why It Matters

CISA lists this CVE in the KEV catalog on the basis that it has evidence of exploitation in the wild: the agency's SSVC decision point records exploitation as "active," with technical impact "total" and automatable "no." No technical details of observed exploitation have been published alongside the listing, and known ransomware campaign use is recorded as Unknown. The KEV entry flags this CVE for Forensic Triage, meaning agencies must apply CISA's Forensics Triage Requirements in addition to patching.

What's Vulnerable

Linux kernel versions from 2.6.38 onward are affected. Fixed stable releases are 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, and 6.17 and later. Kernel versions prior to 2.6.38 are unaffected, while 6.17 release candidates (rc1–rc6) are listed as affected.

Because this is an open-source component, downstream products inherit the flaw. Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, and SIPLUS S7-1500 CPU 1518-4 PN/DP MFP are listed as affected at V3.1.6 and later.

Patch Status

Fixed upstream across seven stable-branch commits. CISA's required action: apply mitigations per vendor instructions in compliance with BOD 26-04 and the Forensics Triage Requirements; follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and adhere to BOD 26-04 patching guidelines.

Sources