Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2025-39964 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2025 |
| Date Published | 2026-09-18 |
| Vendor | Linux |
| Product | Kernel |
| CVSS Score | 7.8 (high) |
| EPSS Score | 0.3% (percentile: 26%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-21 |
Vulnerability Description
Source: CISA KEV
The Linux Kernel contains a race condition on concurrent writes to the same AF_ALG socket.
The result is unpredictable interleaving of data and inconsistencies in the socket’s internal state. Put differently: when two threads write at once, the outcome is neither stream, and the structure describing the socket stops matching reality.
AF_ALG is the interface through which user space reaches the kernel crypto subsystem. Corrupting state consistency at exactly that point is troubling for two reasons: it affects operations whose correctness higher layers take as given, and race conditions are inherently hard to catch with functional tests — they surface only under load.
The reach extends beyond servers. The NVD CPE entry covers not only linux:linux_kernel but also Siemens SIMATIC S7-1500 controllers (the CPU 1518-4 PN/DP MFP and 1518F-4 PN/DP MFP variants). Organisations with industrial infrastructure should include that layer in their review, not just conventional IT systems.
The entry appears in the CISA KEV catalog as actively exploited, and the assigned remediation deadline of 2026-09-21 has passed.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects systems based on the Linux Kernel, and per the CPE entry also Siemens SIMATIC S7-1500 controllers in the listed MFP variants.
That second group deserves separate handling. PLCs rarely sit within the same vulnerability management process as servers, have longer life cycles and far scarcer maintenance windows — an update may only be feasible during a planned shutdown. If your organisation has an OT footprint, list the affected controllers now and plan a separate track for them, restricting network access to the control layer until the update lands.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
