CVE-2025-39964

Act now ● On CISA KEV — actively exploited

Actively exploited — on the CISA KEV list.

CVSS base

7.8 HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — probability of exploitation (30 days)

0.3%

25.6th percentile

CISA KEV

Listed

Added 2026-09-18 · patch by 2026-09-21

Weakness / dates

CWE-362

Published 2025-10-13 · modified 2026-09-18

CVSS breakdown

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector	L	Local
Attack Complexity	L	Low
Privileges Required	L	Low
User Interaction	N	None
Scope	U	Unchanged
Confidentiality	H	High
Integrity	H	High
Availability	H	High

Timeline

2025-10-13 — Published (NVD)
2026-09-18 — Added to CISA KEV (actively exploited)
2026-09-21 — CISA patch-by deadline
2026-09-18 — Last modified (NVD)

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

Affected

linux siemens

References

Official: NVD · CVE.org