CVE-2025-39964

MediumCVSS 5.5/10Known exploited (CISA KEV)Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state.

Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Oct 13, 2025
Last modified
Oct 19, 2026
Added to CISA KEV
Sep 18, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-399655.5In the Linux kernel, the following vulnerability has been resolved: xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SCVE-2025-399667.0In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput() doesn't actCVE-2025-399677.8In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow CVE-2025-399687.3In the Linux kernel, the following vulnerability has been resolved: i40e: add max boundary check for VF filters There is no check for max CVE-2025-399698.8In the Linux kernel, the following vulnerability has been resolved: i40e: fix validation of VF state in get resources VF state I40E_VF_STACVE-2025-39974.3A vulnerability classified as problematic has been found in dazhouda lecms 3.0.3. This affects an unknown part of the file /index.php?my-proCVE-2025-399708.8In the Linux kernel, the following vulnerability has been resolved: i40e: fix input validation logic for action_meta Fix condition to checCVE-2025-399718.8In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within ranCVE-2025-399728.8In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in i40e_validate_queue_map Ensure idx is withCVE-2025-399738.8In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter proviCVE-2025-39974In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit() WhenCVE-2025-399759.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix wrong index reference in smb2_compound_op() In smb2_c
CVE-2025-39964: Medium severity, CVSS 5.5 | Vulnix