Linux Kernel Race Condition Vulnerability
Linux kernel AF_ALG race condition: concurrent writes corrupt state, crashing the system or corrupting cryptographic output. CVSS 7.8. CISA KEV Sept. 18.
- Vendor
- Linux
- Product
- Kernel
- CVSS
- 7.8
- EPSS (exploit probability)
- 1.6%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2025-39964 being exploited?
Yes. CISA added CVE-2025-39964 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 1.6% (scored November 2, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2025-39964 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
Race condition in AF_ALG (the Linux kernel’s crypto interface) socket operations. When two concurrent writes target the same AF_ALG socket, the data they send interleaves unpredictably and leaves the socket’s internal state inconsistent. The result can be a system crash or corrupted cryptographic output.
CISA added this to the Known Exploited Vulnerabilities catalog on September 18, 2026 with active exploitation confirmed. Federal agencies have until September 21, 2026 under BOD 26-04. NVD notes affected versions may include end-of-life kernel releases. See the NVD record and your distribution vendor’s advisories for version details.
Full coverage: CISA Adds Three Exploited Linux Kernel Flaws to KEV.
Other Linux Kernel CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-46300 Linux Kernel Missing Initialization of a Variable Vulnerabilitywrite-up | [ HIGH ] | 7.8 | 16.1% | |
| CVE-2026-98432 Linux Kernel IPv4 TCP Use-After-Freewrite-up | [ CRITICAL ] | 9.8 | 0.8% | — |
| CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerabilitywrite-up | [ HIGH ] | 8.8 | 0.9% | |
| CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerabilitywrite-up | [ CRITICAL ] | 9.8 | 3.3% | |
| CVE-2026-53362 Linux Kernel Unspecified Vulnerability | [ HIGH ] | 7.8 | 0.7% | |
| CVE-2022-0995 Linux Kernel Out-of-Bounds Write Vulnerability | [ HIGH ] | 7.8 | 8.9% | |
| CVE-2026-53264 Linux kernel traffic-control subsystem use-after-free racewrite-up | [ HIGH ] | 7.8 | 0.5% | — |
| CVE-2022-0492 Linux Kernel Improper Authentication Vulnerability | [ HIGH ] | 7.8 | 5.5% |
