CVE-2025-39964 · Moderate · CISA KEV

Linux Kernel Race Condition: Data Inconsistency & State Corruption via AF_ALG Socket

Threat Engine Auto-Feed · data current as of 2026-09-18

CVE-2025-39964, a race condition in the Linux Kernel's AF_ALG socket, allows concurrent writes to unpredictably interleave data, leading to inconsistencies and internal state corruption. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild, despite a low EPSS percentile.

  • CVSS:
  • EPSS percentile: 0.25393
  • Exploitation pressure: 40/100 (Moderate)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 25th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

A race condition occurs when the timing or order of events affects the correctness of a program. In this case, multiple operations (concurrent writes) are trying to modify the same resource (an AF_ALG socket) at the same time without proper synchronization. This leads to unpredictable data interleaving and corruption of the socket's internal state.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Any organization utilizing Linux Kernel, especially those with custom or performance-critical applications heavily using AF_ALG sockets for cryptographic operations or other algorithms.
  • Financial services and Technology sectors, given the documented interest from financially motivated and state-sponsored threat actors.
  • Environments where multiple processes or threads frequently write to the same AF_ALG socket concurrently.

Misconfigurations that escalate it

  • Lack of proper synchronization mechanisms when multiple processes or threads interact with AF_ALG sockets.
  • Insufficient monitoring for unexpected data inconsistencies or crashes related to AF_ALG socket usage.

High-impact scenarios

  • Data corruption or integrity loss in applications relying on AF_ALG sockets, potentially leading to incorrect cryptographic operations or system instability.
  • Denial of service or system crashes due to corrupted internal socket state.
  • Potential for further exploitation if the corrupted state can be manipulated to achieve privilege escalation or arbitrary code execution, though not explicitly stated in the facts.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor for unexpected application crashes or errors related to AF_ALG socket operations.
  • Look for unusual data inconsistencies or integrity check failures in applications utilizing AF_ALG.
  • Implement robust logging for AF_ALG socket interactions to identify concurrent write patterns.

Contain

  • Isolate affected systems or applications that heavily rely on AF_ALG sockets and exhibit symptoms.
  • Temporarily disable or restrict access to services that utilize AF_ALG sockets if immediate patching is not feasible and symptoms are observed.

Patch

  • Apply the latest security patches for the Linux Kernel as soon as they become available to address CVE-2025-39964.

Frontier verdict — Moderate

High priority due to active exploitation (CISA KEV) and potential for data corruption and system instability in Linux Kernel environments.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.