In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce cve-icon cve-icon
https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 cve-icon cve-icon
https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8 cve-icon cve-icon
https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042 cve-icon cve-icon
https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84 cve-icon cve-icon
https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d cve-icon cve-icon
https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025101334-CVE-2025-39964-7964@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-39964 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-39964 cve-icon
History

Mon, 20 Oct 2025 16:15:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Tue, 14 Oct 2025 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Mon, 13 Oct 2025 14:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.
Title crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2025-10-13T13:48:30.334Z

Updated: 2025-10-13T13:48:30.334Z

Reserved: 2025-04-16T07:20:57.149Z

Link: CVE-2025-39964

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-10-13T14:15:34.737

Modified: 2025-10-14T19:36:29.240

Link: CVE-2025-39964

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-10-13T00:00:00Z

Links: CVE-2025-39964 - Bugzilla