CISA Adds CVE-2025-39964 Linux Kernel Flaw to KEV

Executive Summary

CISA added CVE-2025-39964, a race condition in the Linux kernel's AF_ALG socket interface, to its Known Exploited Vulnerabilities (KEV) catalog. The addition carries a federal remediation deadline of September 21, 2026, three days from today, under Binding Operational Directive 26-04.

The vulnerability allows concurrent writes to the same AF_ALG socket to interleave data unpredictably, corrupting the socket's internal state. AF_ALG is the kernel's userspace interface to cryptographic algorithm implementations; software that relies on it for cryptographic operations may be affected. CISA's KEV listing is the strongest public signal that the flaw is being exploited in the wild, though the catalog entry does not name a threat actor, victim, or observed exploitation vector.

Defenders running Linux systems — particularly those exposed to untrusted input that reaches AF_ALG — should treat this as a priority patch. The absence of a published CVSS score or vendor severity rating in the KEV entry means teams should not wait for a numeric score before scheduling remediation.

Technical Analysis

According to the CISA KEV entry, CVE-2025-39964 is a race condition in the Linux kernel that permits concurrent writes to the same AF_ALG socket. The result, per CISA's description, is that data is "unpredictably interleaved," producing inconsistencies in the socket's internal state.

AF_ALG (AF_ALG address family) exposes kernel cryptographic primitives to userspace via sockets. Applications that use the interface — including some TLS offload paths, disk encryption tooling, and cryptographic libraries configured to use kernel crypto — send and receive data through these sockets. A race condition that corrupts socket state can, depending on how the kernel handles the inconsistency, lead to incorrect cryptographic output, memory-safety issues in kernel context, or denial of service. CISA's entry does not specify which of these outcomes has been observed in exploitation.

The KEV entry does not include a CVSS base score, a CWE identifier, or a named affected kernel version range. It also does not name an exploitation campaign, threat actor, or victim. The required action is to "apply mitigations in accordance with vendor instructions," with a fallback to discontinue use of the product if mitigations are unavailable.

Because the flaw is in the kernel itself, the practical remediation path is a kernel update from the distribution vendor (or, for downstream consumers, from the platform vendor shipping the kernel). CISA's note directs stakeholders to evaluate each asset's internet exposure and to follow BOD 26-04 patching guidelines. The September 21, 2026 due date applies to federal civilian executive branch agencies; private-sector defenders should treat it as a strong prioritization signal rather than a binding deadline.

CISA also references "Forensics Triage Requirements" in the KEV entry notes. That language indicates that, for federal agencies, the vulnerability triggers incident-response and forensic obligations in addition to patching — a signal that CISA considers exploitation plausible enough to warrant investigation, not just remediation.

Mitigations & Recommendations

The primary action is to apply the kernel update provided by your Linux distribution or platform vendor. Because CISA's KEV entry does not enumerate affected versions, defenders should consult their vendor's advisory for the specific kernel builds that carry the fix, rather than assuming a single upstream version resolves the issue across all distributions.

For systems that cannot be patched immediately, CISA's KEV guidance permits discontinuing use of the affected product if mitigations are unavailable. In practice, that means either removing the system from service or isolating it from untrusted input. Reducing exposure of AF_ALG to untrusted callers — for example, by restricting which processes can open AF_ALG sockets via seccomp or LSM policy — may limit reachability, but CISA does not endorse a specific workaround in the KEV entry, and defenders should not treat such controls as a substitute for patching.

Given the forensic triage language in the KEV entry, federal agencies should also check whether their incident-response playbooks cover kernel-level race conditions and whether host telemetry captures AF_ALG socket operations. Private-sector teams with internet-exposed Linux infrastructure should prioritize the same systems they would for any kernel memory-corruption or cryptographic-integrity flaw.