A 14-year-old Linux kernel flaw in the AF_ALG cryptographic socket interface allows unprivileged local users to gain root privileges and escape Docker containers. This vulnerability, tracked as CVE-2025-39964, arises from a race condition in concurrent sendmsg() operations, enabling an out-of-bounds memory access and ultimately an arbitrary kernel write. Security researcher Muhammad Alifa Ramdhan discovered the issue in 2025 while auditing Linux kernel attack surfaces for Google’s kernelCTF program.

His research, aided by STAR Labs colleague Bing-Jhong Billy Jheng, produced a local privilege-escalation exploit and earned a $113,337 kernelCTF reward. An application can create an AF_ALG socket, bind it to a cryptographic algorithm like AES-CBC, and send input through sendmsg() for later encryption or decryption.

Typically, when a partial page is left accessible, the AF_ALG context flags a merge flag to allow the next write to append data to the final scatterlist entry. By precisely timing these operations, an attacker can create an unexpected state where the merge flag remains enabled while the newest scatter-gather list contains no valid entries. A usercopy behavior in memcpy_from_msg() offered an oracle: failed destinations return EFAULT, enabling the exploit to locate usable memory and refine the write target.

Organizations should deploy vendor kernel updates that include the AF_ALG concurrency fix and treat unpatched multi-tenant or container-hosting systems as especially vulnerable. Explore for your team.