CVE-2025-39964

CISA KEV

ACT NOW Priority: 0.00 BB Relevance: 0/100

Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.

CISA Known Exploited Vulnerability

Vendor / Product Linux — Kernel

Date Added 2026-09-18

Remediation Due 2026-09-21

This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce; https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9; https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8; https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84; https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d; https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042; https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-39964

Weakness Classification (1)

CWE-362

Affected Software (14)

Vendor	Product	Version
linux	linux_kernel	2.6.38 – 5.10.245
linux	linux_kernel	5.11 – 5.15.194
linux	linux_kernel	5.16 – 6.1.154
linux	linux_kernel	6.2 – 6.6.108
linux	linux_kernel	6.7 – 6.12.49
linux	linux_kernel	6.13 – 6.16.9
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
siemens	simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware	≥ 3.1.6
siemens	simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware	≥ 3.1.6