CVE-2025-39964: Linux Kernel Race Condition Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 18 Sep 2026, 340 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 1.6%
EPSS score, percentile 75.3 of all scored records
- How severe?
- 7.8 High
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA deadline 21 Sep 2026. Apply mitigations in accordance with vendor instructions … Full text
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- 2.6.38
Unaffected before 2.6.38; 5.10.245; 5.15.194; 6.1.154; 6.6.108; 6.12.49; and 2 more
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
What to do
Required action, set by CISA
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date for this action: 21 September 2026.
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
- https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce
- https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9
- https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8
- https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84
- https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d
- https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | from 8ff590903d5f to before 0f28c4adbc4a |
| Affected | from 8ff590903d5f to before e4c1ec11132e |
| Affected | from 8ff590903d5f to before 1f323a48e9b5 |
| Affected | from 8ff590903d5f to before 7c4491b5644e |
| Affected | from 8ff590903d5f to before 9aee87da5572 |
| Affected | from 8ff590903d5f to before 45bcf60fe49b |
| Affected | from 8ff590903d5f to before 1b34cbbf4f01 |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | 2.6.38 |
| Unaffected | before 2.6.38 |
| Unaffected | 5.10.245 |
| Unaffected | 5.15.194 |
| Unaffected | 6.1.154 |
| Unaffected | 6.6.108 |
| Unaffected | 6.12.49 |
| Unaffected | 6.16.9 |
| Unaffected | 6.17 |
Versions not listed are: affected.
Versions the record lists as unaffected: 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9, 6.17.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
About this vulnerability
Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
Summary: CISA's KEV catalog, as of 28 Oct 2026.
- CISA added CVE-2025-39964 to its Known Exploited Vulnerabilities (KEV) catalog on 18 Sep 2026.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 21 Sep 2026.
- The CVE record was published on 13 Oct 2025, 340 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 7.8 (High), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 1.6% (percentile 75.3), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026. About the data.
Description
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Weakness
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| 13 Oct 2025 | CVE record published |
| 18 Sep 2026 | Added to CISA KEV |
| 21 Sep 2026 | CISA due date for the required action |
| 15 Oct 2026 | CVE record last updated |
References
More exploited Linux vulnerabilities
- CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
- CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2026-53362: Linux Kernel Unspecified Vulnerability
- CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability