CVE-2025-39964 Exploited in the wild

Linux Kernel Race Condition Vulnerability

Risk score: 83/100
CVSS: Not Scored
Added to CISA's exploited list: 18 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
Affected: Linux Kernel
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: Exploited in the wild

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Linux Kernel: Red, act today. A vulnerability in the Linux kernel allows an attacker to decrypt in place over page-cache backed frags, potentially leading to a high impact on confidentiality, integrity, and availability.

The flaws

CVE-2025-39964: Linux Kernel Race Condition Vulnerability (exploited)
CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability (CVSS 7.8 · EPSS 10% · exploited)
CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability (exploited)
CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability (exploited)

The fix

Fix: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 guidance and CISA’s “Forensics Triage Requirements”

Who is exposed: {'product': 'linux kernel', 'vendor': 'linux'}

Where it stands

Exploited in the wild
On CISA's exploited list since 18 Sep
US federal deadline 21 Sep
1 outlet covering it

How it unfolded

18 Sep, CISA (official): Added to the Known Exploited Vulnerabilities list (4 of these flaws)
21 Sep, Deadline (official): US federal agencies must have patched
28 Oct, CISA advisories (US) (official): CISA Adds Two Known Exploited Vulnerabilities to Catalog
28 Oct, SecurityWeek (press): China-Linked Hackers Exploit PHP2Shell to Root Firewalls

Connects to

Same weakness: Race condition (CWE-362). 99 other warnings in 30 days
Same product: Earlier Linux Kernel warnings. 2 in the last 90 days
Reported alongside: PHP Stale Internal Request-State Vulnerability. CVE-2026-109619 · in 1 of the same article

Why it is Red

Not yet scored by NVD
Exploited in the wild (CISA KEV)
On your watchlist: linux kernel

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Original description

Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.

Last activity 18 Sep 2026. Patch Forecast updates every hour.