A vulnerability in the Linux kernel’s AF_ALG cryptographic interface, which has existed for 14 years, can let an unprivileged local attacker gain root access and escape a Docker container by exploiting a race condition in concurrent socket writes.
This flaw, tracked as CVE-2025-39964, was discovered in 2025 by STAR Labs researcher Muhammad Alifa Ramdhan, with help from Bing-Jhong Billy Jheng to complete the exploitation chain.
Their working Linux kernel CTF submission earned them a reward of $113,337 from Google. The vulnerable code originated in Linux 2.6.38, released in 2011, allowing the defect to go unnoticed for roughly 14 years before its correction in 2025.
The AF_ALG interface exposes kernel cryptographic operations, including hashing, symmetric encryption, authenticated encryption, and random number generation, to user-space applications via standard sockets.
Programs can create an AF_ALG socket, choose an algorithm, and use send or write calls to provide data, subsequently retrieving results through read or receive operations. Significantly, this interface is accessible from unprivileged user space, making flaws within it an appealing attack target.
The vulnerability resides in the function `af_alg_sendmsg()`, which collects supplied input in transmit scatter-gather lists. A shared `af_alg_ctx` structure maintains state information regarding whether more data is expected and whether new input can be merged into the remaining space on the last allocated page.
Although `lock_sock()` initially appears to ensure serialized writes, the kernel releases that lock while a writer waits for socket memory. This behavior allows two threads to perform unfinished `sendmsg()` operations against the same socket.
A carefully timed interleaving, combined with a failed userspace copy, can set `ctx->merge` to true. At the same time, the newest scatterlist has `cur` equal to zero.
Following this, a write operation assumes that a valid final entry exists and computes `sgl->sg + sgl->cur – 1`. With `cur` set to zero, the kernel instead accesses `sg[-1]`, reading metadata from memory that immediately precedes the allocation.
According to IDNSec, Attackers can exploit this by heap-spraying a neighboring object, influencing the fake `page_link` value used to calculate the destination for `memcpy_from_msg()`.
The exploit transforms this out-of-bounds metadata access into a write primitive using usercopy fault handling as an oracle. When a guessed destination maps to writable memory, `sendmsg()` succeeds; when it is unmapped, the copy returns EFAULT without crashing the kernel.
By repeatedly probing, the attacker can identify the calculated location, allowing them to redirect writes to the kernel page that contains `core_pattern`.
By replacing `core_pattern` with a command pointing to the exploit binary and deliberately crashing a child process, the researchers succeeded in executing their binary as the root-privileged core-dump handler.
Because a container shares the host’s kernel and AF_ALG is accessible in the tested Docker environment, this exploit provided root access on the host, enabling a container escape.
The upstream fix implements exclusive write ownership through `ctx->write`. A second writer attempting `sendmsg()` on the same AF_ALG socket will now receive an EBUSY error until the first operation completes, thereby preventing the inconsistent state.
Administrators are advised to install kernel updates provided by their distribution; stable fixed versions include 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, and 6.16.9.
This change enforces the single-writer assumption that AF_ALG previously relied upon during memory-pressure waits, interleaved operations, copy failures, and error-path cleanup within `af_alg_sendmsg()`.
CISA added CVE-2025-39964 to its Known Exploited Vulnerabilities catalog on September 18, 2026, underscoring the urgency of patching. Organizations should inventory host and container kernels, prioritize internet-facing and multi-tenant systems, and restrict AF_ALG through security policies where operationally feasible until updates are deployed.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…