CVE-2025-39964: Linux Kernel

What is CVE-2025-39964?

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

CVSS5.5 NVD 3.1

SeverityMEDIUM

Exploitation In the wild In CISA KEV

EPSS1% · P55

Triage statusActive Exploit

ActionPatch immediately

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWECWE-362

NVD published2025-10-13

NVD last modified2026-09-19

Timeline

2025-10-13Published to the U.S. National Vulnerability Database (NVD)
2026-09-18Added to the CISA Known Exploited Vulnerabilities (KEV) catalog
2026-09-19NVD record last updated
2026-09-20First covered in a defend.network daily briefing
2026-09-21CISA federal remediation deadline (BOD 22-01)

CISA Known Exploited Vulnerability

Linux Kernel Race Condition Vulnerability

Added to KEV2026-09-18

Federal patch deadline2026-09-21

Known ransomware useUnknown

Affected product

Linux Kernel

NVD also lists CPE entries for: Linux Kernel, Siemens Simatic S7-1500 Cpu 1518-4 Pn\/Dp Mfp Firmware, Siemens Simatic S7-1500 Cpu 1518-4 Pn\/Dp Mfp, Siemens Simatic S7-1500 Cpu 1518f-4 Pn\/Dp Mfp Firmware, Siemens Simatic S7-1500 Cpu 1518f-4 Pn\/Dp Mfp

Remediation Steps

Consult CISA Known Exploited Vulnerabilities catalog for advisory details
Apply the vendor patch for the affected Linux component
Verify patching across all Linux systems in your environment

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of September 2026 (September 21 – 27)
SolarWinds, Orkes RCE flaws under exploitation; Linux kernel vulnerabilities added to CISA KEV (2026-09-20)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.