14-Year-Old Vulnerability in Linux Kernel Exposes Unprivileged Users to Root Access
A significant security vulnerability has been identified in the Linux kernel’s AF_ALG cryptographic interface, posing a severe threat to both users and containers alike. This flaw has existed for approximately 14 years and allows an unprivileged local attacker to gain root access and escape from a Docker container. The issue arises from a race condition linked to concurrent socket writes, specifically within the function af_alg_sendmsg().
Discovered in early 2025 by researcher Muhammad Alifa Ramdhan from STAR Labs, the vulnerability has been designated the identifier CVE-2025-39964. Ramdhan received assistance from colleague Bing-Jhong Billy Jheng to finalize the exploit chain. Their successful exploitation submission during a Linux kernel Capture The Flag (CTF) competition was rewarded with a notable payout of $113,337 from Google, highlighting the importance of bug bounties in reinforcing software security.
The vulnerable code traces back to Linux kernel version 2.6.38, which was released in 2011. This flaw remained undetected for over a decade, affecting countless systems susceptible to exploitation. Cybersecurity experts emphasize the urgency of addressing such vulnerabilities, particularly when they involve fundamental components like the kernel, which serves as the core interface between a computer’s hardware and software.
The AF_ALG interface plays a crucial role in facilitating cryptographic operations within the Linux environment. It exposes these operations—including hashing, symmetric encryption, authenticated encryption, and random number generation—to user-space applications through standard sockets. Applications can create AF_ALG sockets, choose cryptographic algorithms, and perform send or write operations to submit data, later receiving results through read operations. However, the accessibility of the AF_ALG interface from unprivileged user space renders it an attractive target for malicious actors.
The vulnerability in question arises from the way af_alg_sendmsg() handles data input, particularly in managing its transmit scatter-gather lists. A shared structure called af_alg_ctx maintains vital state information about ongoing operations, including whether more data is expected and whether new input can be merged into available space in the last allocated memory page.
At first glance, it would seem that employing lock_sock() would streamline serialized writes, but a critical flaw exists: the kernel releases that lock while a writer awaits socket memory. Consequently, two threads may simultaneously attempt to perform sendmsg() operations on the same socket. Under certain conditions, this timing can expose a weakness wherein it is possible to manipulate ctx->merge, thereby allowing one thread to erroneously verify an incomplete operation.
This manipulation triggers an out-of-bounds memory access, allowing attackers to exploit the gap. By conducting a heap-spray attack, they can influence the fake page_link value that eventually directs a memory operation. The manipulation could turn what starts as a readout into a write primitive, using usercopy fault handling to nullify erroneous writes. Identifying writable memory mapping can give attackers the leverage they need to execute further exploits, including executing their binaries with root privileges.
The researchers demonstrated their attack by replacing core_pattern with a command that points directly to their exploit binary. Once a child process was deliberately crashed, they achieved execution of the binary as the root-privileged core-dump handler, thereby gaining unattainable access. Given that Docker containers share the host’s kernel, the exploitation resulted in a complete escape from the intended isolation provided by containerization technology.
In response to this vulnerability, a patch has been released to rectify the issues in the kernel’s handling of concurrent socket writes. The upstream fix implements exclusive write ownership through the ctx->write variable. Now, any second writer attempting to use sendmsg() on the same socket while another operation is in progress will receive an EBUSY error until the first write concludes. This implementation effectively removes the inconsistent state that led to the vulnerability.
Administrators are strongly encouraged to update their kernel versions as provided by their distribution. The patched stable releases include versions 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, and 6.16.9.
Despite these fixes, cybersecurity awareness remains paramount. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-39964 to its Known Exploited Vulnerabilities catalog as of September 18, 2026, emphasizing an urgent need for patching. Organizations are advised to conduct an inventory of host and container kernels, especially prioritizing systems that are accessible over the Internet or used in multi-tenant environments. Additionally, restricting the use of AF_ALG through security policies is recommended as a temporary measure until all updates have been deployed.
In a world where cyber threats grow more sophisticated by the day, vigilance and timely action remain essential in safeguarding systems from vulnerabilities that can compromise security at multiple levels. This incident serves as a reminder of the importance of maintaining rigorous security protocols and promptly addressing newly discovered vulnerabilities.