CVE-2025-39964 is a Linux kernel AF_ALG race condition vulnerability that enables local privilege escalation from a regular user to root. The bug allows concurrent writers to leave the kernel in an invalid state where an out-of-bounds scatterlist access leaks heap metadata, which is then leveraged for an arbitrary kernel write via the usercopy oracle. The exploit overwrites core_pattern to achieve root access and Docker container escape, earning the researcher a $113,337 Google kernelCTF bounty.
Background
AF_ALG is a Linux kernel subsystem exposing cryptographic algorithms to userspace via socket API. Kernel privilege escalation vulnerabilities in commonly used subsystems like this have significant impact as they can be exploited for container escape and system compromise.
- Source
- Lobsters
- Published
- Sep 27, 2026 at 03:29 AM
- Score
- 8.0 / 10