A 14-year-old Linux kernel vulnerability in the AF_ALG cryptographic socket interface allows unprivileged local users to gain root privileges and escape Docker containers This article explores kernel vulnerability af_alg. . This issue, tracked as CVE-2025-39964, arises from a race condition in concurrent sendmsg() operations that can be exploited to perform an out-of-bounds memory access and ultimately an arbitrary kernel write.
Research conducted by Muhammad Alifa Ramdhan, a security researcher at Google, uncovered this flaw during his audit of the Linux kernel attack surfaces as part of the kernelCTF program. The exploit, developed with the assistance of STAR Labs colleague Bing-Jhong Billy Jheng, successfully demonstrated a local privilege escalation and earned a $113,337 kernelCTF reward.
An application can create an AF_ALG socket, bind it to a cryptographic algorithm like AES-CBC, and submit input through sendmsg() for later encryption or decryption. By carefully timing these operations, an attacker can create an unexpected state where the merge flag remains active while the newest scatter-gather list contains no valid entries. A usercopy behavior in memcpy_from_msg() provided an oracle: failed destination guesses return EFAULT rather than crashing the system, allowing the exploit to identify usable memory locations and refine the write target.
Upstream fixed the issue in 2025 by preventing concurrent writers from operating on the same AF_ALG context; a second writer now receives -EBUSY while a write is active.
