Security readout for executives and security teams
Plain-English summary
A Linux kernel flaw allows concurrent writes to the same kernel cryptography socket, causing unpredictable data mixing and inconsistent internal state. The supplied CVSS rates potential confidentiality, integrity, and availability impact as high. Exploitation requires local, low-privileged access; this is not described as directly remotely exploitable.
Executive priority
Treat this as a high-priority kernel maintenance issue, especially on systems shared with untrusted or low-privileged users. It does not warrant the urgency of a confirmed remote or actively exploited flaw, but the potential system-wide impact supports prompt, controlled patching after identifying applicable vendor builds.
Technical view
The affected af_alg_sendmsg path did not prevent simultaneous writers on one AF_ALG socket. Their data could interleave unpredictably and corrupt socket state. The kernel fix adds a ctx->write field to enforce exclusive write ownership. The sources do not describe a demonstrated path from this inconsistency to each CVSS impact.
Likely exposure
Exposure is most relevant where low-privileged local users or processes can access affected AF_ALG functionality. The record identifies affected Linux versions and several branch-specific fixes, but its version encoding is insufficient to map every distribution package reliably. Confirm exposure through vendor advisories and patch presence.
Exploitation context
The supplied CVSS is 7.8: local access, low complexity, low privileges, and no user interaction. The bundle marks the CVE as absent from KEV and provides no evidence of active exploitation or a public proof of concept. Absence of cited evidence does not establish that exploitation is impossible.
Researcher notes
The root condition is concurrent af_alg_sendmsg activity against one socket, producing interleaving and internal-state inconsistency. Multiple stable commits indicate branch-specific backports. Exact vulnerable ranges, concrete corruption outcomes, exploit reliability, and detection indicators are not established by the supplied material, so patch-presence verification is more dependable than simple version comparison.
Mitigation direction
- Apply the vendor-supported kernel update containing the applicable kernel.org fix for each deployed branch.
- Inventory Linux kernels and prioritize hosts allowing untrusted or low-privileged local workloads.
- Use distribution advisories to map patched package versions; do not rely solely on upstream version strings.
- If patching is delayed, review vendor guidance; the supplied sources name no specific workaround.
Validation and detection
- Record running kernel builds and compare them with applicable vendor advisories and affected-version data.
- Verify that each deployed kernel contains the appropriate stable fix commit or vendor backport.
- After updating, confirm systems booted into the remediated kernel build.
- Recheck inventories for active or bootable vulnerable kernels.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-39964 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ceCVE reference, Linux
- https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9CVE reference, Linux
- https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8CVE reference, Linux
- https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84CVE reference, Linux
- https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3dCVE reference, Linux
- https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042CVE reference, Linux
- https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285CVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.