MIDDEL · CVSS 5.5
ACTIEF MISBRUIKT
PATCH BESCHIKBAAR
CVE-2025-39964: Linux Kernel Race Condition Vulnerability
| Leverancier | Linux |
|---|---|
| Product | Kernel |
| CVSS-score | 5.5 · CVSS 3.1 · MIDDELCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
| Actief misbruikt | Ja |
| Toegevoegd aan CISA KEV | 18 sep 2026 |
| CISA-deadline (Amerikaanse overheid) | 21 sep 2026 |
| Zwakte (CWE) | CWE-362 |
| Gepubliceerd in NVD | 13 okt 2025 |
| Laatst gewijzigd in NVD | 10 nov 2026 |
| NVD-status | Analyzed |
Getroffen versies
| Product | Getroffen versies | Opgelost in |
|---|---|---|
| Linux Linux Kernel | vanaf 2.6.38 vóór 5.10.245 | 5.10.245 |
| Linux Linux Kernel | vanaf 5.11 vóór 5.15.194 | 5.15.194 |
| Linux Linux Kernel | vanaf 5.16 vóór 6.1.154 | 6.1.154 |
| Linux Linux Kernel | vanaf 6.7 vóór 6.12.49 | 6.12.49 |
| Linux Linux Kernel | vanaf 6.13 vóór 6.16.9 | 6.16.9 |
| Linux Linux Kernel | vanaf 6.2 vóór 6.6.108 | 6.6.108 |
| Linux Linux Kernel | 6.17 | – |
| Linux Linux Kernel | 6.17 | – |
| Linux Linux Kernel | 6.17 | – |
| Linux Linux Kernel | 6.17 | – |
| Linux Linux Kernel | 6.17 | – |
| Linux Linux Kernel | 6.17 | – |
| Siemens Simatic S7-1500 Cpu 1518-4 Pn\/Dp Mfp Firmware | vanaf 3.1.6 | – |
| Siemens Simatic S7-1500 Cpu 1518F-4 Pn\/Dp Mfp Firmware | vanaf 3.1.6 | – |
Vereiste actie (tekst van CISA, Engels)
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Beschrijving (NVD, Engels)
In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
Issuing two writes to the same af_alg socket is bogus as the
data will be interleaved in an unpredictable fashion. Furthermore,
concurrent writes may create inconsistencies in the internal
socket state.
Disallow this by adding a new ctx->write field that indiciates
exclusive ownership for writing.
BRONNEN
Andere lekken bij Linux
- CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- CVE-2026-53362: Linux Kernel Unspecified Vulnerability
- CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability
Gegevens van NVD, CISA KEV, FIRST EPSS en adviezen van leveranciers. Bijgewerkt 10 nov 2026.