Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-39964

CVE-2025-39964MEDIUM

Linux Linux — crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  N  N  H    5.5   .0100   61.4   YES

AFFECTED
  Product  Versions                                    Fixed
  Linux    8ff590903d5fc7f5a0a988c38267a3d08e6393a2 –  —
  Linux    2.6.38 –                                    5.10.245

TIMELINE
  Apr 16  Reserved by Linux
  Oct 13  Published (CNA: Linux)
  Jul 30  RESCORED — CVE-2025-39964 (Linux). CVSS 7.8 → 3.3 (NVD).
  Sep 18  ADDED TO KEV — CVE-2025-39964 (Linux). Remediation due September 21, 2026.
  Sep 19  RESCORED — CVE-2025-39964 (Linux). CVSS 3.3 → 5.5 (NVD).
  Sep 22  DUE DATE PASSED — CVE-2025-39964 (Linux). CISA remediation deadline was September 21, 2026; still in catalog.

CWE-362 · CNA: Linux · CVSS v3.1 · 9 references · NVD status: Analyzed · KEV due September 21, 2026

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

Lifecycle

Complete event history — 6 events, chronological
Date	Event	Detail
April 16, 2025	Reserved	Reserved by Linux
October 13, 2025	Published	Published (CNA: Linux)
July 30, 2026	RESCORED	RESCORED — CVE-2025-39964 (Linux). CVSS 7.8 → 3.3 (NVD).
September 18, 2026	KEV ADDED	ADDED TO KEV — CVE-2025-39964 (Linux). Remediation due September 21, 2026.
September 19, 2026	RESCORED	RESCORED — CVE-2025-39964 (Linux). CVSS 3.3 → 5.5 (NVD).
September 22, 2026	DUE DATE PASSED	DUE DATE PASSED — CVE-2025-39964 (Linux). CISA remediation deadline was September 21, 2026; still in catalog.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Linux	Linux	—	8ff590903d5fc7f5a0a988c38267a3d08e6393a2	—
Linux	Linux	—	2.6.38	5.10.245

Weaknesses

CWE-362

References (9)

https://cert-portal.siemens.com/productcert/html/ssa-019113.html [Third Party Advisory]
https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce [Patch]
https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 [Patch]
https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8 [Patch]
https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042 [Patch]
https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84 [Patch]
https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d [Patch]
https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9 [Patch]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964 [US Government Resource]

Authoritative record: CVE-2025-39964 at cve.org

Vendors: linux

Weaknesses: CWE-362

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-39964 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.