MEDIUM · CVSS 5.5
ACTIVELY EXPLOITED
PATCH AVAILABLE
CVE-2025-39964: Linux Kernel Race Condition Vulnerability
| Vendor | Linux |
|---|---|
| Product | Kernel |
| CVSS score | 5.5 · CVSS 3.1 · MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Actively exploited | Yes |
| Added to CISA KEV | 18 Sep 2026 |
| CISA federal deadline | 21 Sep 2026 |
| Weakness (CWE) | CWE-362 |
| NVD published | 13 Oct 2025 |
| NVD last modified | 10 Nov 2026 |
| NVD status | Analyzed |
Affected versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux Kernel | from 2.6.38 before 5.10.245 | 5.10.245 |
| Linux Linux Kernel | from 5.11 before 5.15.194 | 5.15.194 |
| Linux Linux Kernel | from 5.16 before 6.1.154 | 6.1.154 |
| Linux Linux Kernel | from 6.7 before 6.12.49 | 6.12.49 |
| Linux Linux Kernel | from 6.13 before 6.16.9 | 6.16.9 |
| Linux Linux Kernel | from 6.2 before 6.6.108 | 6.6.108 |
| Linux Linux Kernel | 6.17 | – |
| Linux Linux Kernel | 6.17 | – |
| Linux Linux Kernel | 6.17 | – |
| Linux Linux Kernel | 6.17 | – |
| Linux Linux Kernel | 6.17 | – |
| Linux Linux Kernel | 6.17 | – |
| Siemens Simatic S7-1500 Cpu 1518-4 Pn\/Dp Mfp Firmware | from 3.1.6 | – |
| Siemens Simatic S7-1500 Cpu 1518F-4 Pn\/Dp Mfp Firmware | from 3.1.6 | – |
Required action (CISA's text)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Description (NVD)
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.
SOURCES
Other Linux flaws
- CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- CVE-2026-53362: Linux Kernel Unspecified Vulnerability
- CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.