Severity: High
A high-severity vulnerability has been disclosed affecting the Linux kernel’s cryptographic socket interface, impacting multiple Linux distributions commonly used across enterprise, cloud and financial infrastructure environments.
The vulnerability, tracked as CVE-2025-39964, is a vulnerability in the Linux kernel’s cryptographic socket interface, specifically in the af_alg (Algorithm) socket implementation within the crypto subsystem. A flaw in the way the af_alg_sendmsg function handles concurrent write operations means that two simultaneous writes to the same af_alg socket can cause data to be interleaved in an unpredictable manner, and may create inconsistencies in the internal state of the socket. A locally authenticated attacker, or a process able to issue concurrent writes to an af_alg socket, could exploit this condition to corrupt cryptographic operations or internal socket state, potentially leading to local privilege escalation, data integrity issues, or a denial of service on the affected host. The fix introduces an exclusive ownership flag to prevent concurrent writes from proceeding simultaneously.
As part of Beeks’ commitment to supporting operational resilience and cyber risk management, this advisory is intended to help organisations assess exposure and implement appropriate mitigations.
Affected software:
- Ubuntu 20.04 – 25.04
- SUSE Linux Enterprise Server 15 SP5 – 15 SP6
- SUSE Linux Enterprise Micro 5.3 – 5.5
- Debian bookworm (6.1 kernel series)
- Debian bullseye (5.10 kernel series)
- Red Hat Enterprise Linux 8 – 9
Immediate Recommended Actions:
- Apply the latest kernel patch provided by your Linux distribution vendor to remediate this vulnerability — this is the primary and most effective remediation.
- Reboot affected systems after patching, as kernel updates do not take effect until the system is restarted unless a live patching service is in use.
- Confirm remediation by verifying the running kernel version with “uname -r” and comparing it against the fixed version published by your vendor.
- Monitor vendor security channels for updated patches and guidance as they become available.
Further Information:
For detailed information on the vulnerability, please refer to the following sources:
https://nvd.nist.gov/vuln/detail/CVE-2025-39964
https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce
For detailed information on how to apply the security patch for this vulnerability, please refer to:
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964
If you have any questions or require further assistance, please contact [email protected] or reach out to your Beeks account representative.
This advisory is issued to help ensure the security of your systems and prevent unauthorised access to sensitive data. Beeks remains committed to providing timely security information and support to safeguard your infrastructure.
Beeks will continue to monitor this and related vulnerabilities and provide updates through our Security Advisory Feed.
