External risk intelligence

Linux Kernel Concurrent Write Vulnerability in AF_ALG Socket

CVE advisoryKnown Exploit

CVE-2025-39964

This vulnerability resides within the Linux kernel's internal AF_ALG socket interface. Exploitation requires local access to the system to interact with the socket, making it inherently internal and not reachable from the public internet.

Linux Kernel

2.6.38 to before 5.10.2455.11 to before 5.15.1945.16 to before 6.1.1546.2 to before 6.6.1086.7 to before 6.12.496.13 to before 6.16.96.173.1.6 and later

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been addressed in the Linux kernel's networking subsystem that prevents concurrent writes to certain sockets, which could lead to unpredictable data interleaving and internal state inconsistencies. While the main concern is confirming relevance and exposure due to its internal nature, understanding its presence is important for maintaining system integrity.

Socket write errors can cause data corruption.
It affects how data is handled internally.
Verify if your systems use this kernel feature.

Attack Path

How an attacker could exploit the issue

An attacker with local access to a system could exploit this vulnerability by sending multiple write requests to the same AF_ALG socket concurrently. This could lead to unpredictable data interleaving and internal socket state inconsistencies, potentially causing denial of service or other unpredictable behavior. The exact impact beyond these inconsistencies is not detailed in the provided context.

Requires local system access.
Triggered by concurrent socket writes.
Can cause data interleaving and instability.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability affects the Linux kernel's AF_ALG socket interface, potentially leading to unpredictable data interleaving and internal state inconsistencies when concurrent writes are attempted. This could impact the integrity of data processed through this specific kernel interface under local access conditions.

Kernel socket communication data.
Local processes writing concurrently.
Unpredictable data, potential state corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's internal AF_ALG socket interface, requiring local access for exploitation. Therefore, teams responsible for systems running the affected Linux kernel versions, such as infrastructure or platform teams, should initiate by identifying all instances of the kernel, assessing their business criticality and network reachability, and locating the accountable system owner. Subsequent remediation planning should align with the identified risk.

Infrastructure and platform teams own the issue.
Verify system criticality and network reachability.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel AF_ALG component?

The AF_ALG interface is a specialized part of the Linux kernel that provides user-space applications access to kernel-based cryptographic services. It allows software to offload encryption or decryption tasks to the kernel's optimized crypto-subsystem. Various systems, including certain Siemens SIMATIC S7-1500 CPU firmware, rely on this kernel infrastructure for secure data processing.

What does CVE-2025-39964 mean for system stability?

This vulnerability is classified as a race condition, specifically CWE-362. It occurs when two processes attempt to write to the same AF_ALG socket simultaneously. Because the kernel lacked a mechanism to manage these conflicting requests, the data becomes interleaved unpredictably. This can result in internal socket state inconsistencies, which may destabilize the specific service using that socket.

How is this vulnerability triggered?

An attacker triggers this bug by initiating multiple, simultaneous write operations to the same AF_ALG socket from a local environment. It does not trigger if only one process is communicating with the socket at a time, or if the socket is used sequentially. The vulnerability requires a specific, multi-threaded, or malicious local attempt to force concurrent writes to the same interface.

Do I need to worry about internet-facing exposure?

According to Halo Surface Signal, this vulnerability is very unlikely to be reachable from the public internet. Because exploitation requires local access to the target system to interact with the kernel socket directly, it is classified as an internal-only threat. You should prioritize internal systems where untrusted local users or restricted processes may operate.

When should I prioritize fixing CVE-2025-39964?

Begin by identifying all assets running the affected Linux kernel versions. Focus your assessment on systems where local security boundaries are critical, such as shared environments or devices running Siemens firmware. Once you have an inventory of these systems, plan your updates based on the business criticality of the device rather than treating it as an immediate remote network threat.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.