A critical Linux kernel vulnerability, known to exist for 14 years, has been identified, allowing local users to gain root access and escape from Docker containers. This flaw, rooted in the AF_ALG userspace cryptographic interface, poses significant risks by enabling unauthorized privilege escalation.
Understanding the AF_ALG Flaw
The vulnerability arises from unsafe concurrent writes within the AF_ALG interface, primarily used for cryptographic operations like AES encryption. Local unprivileged processes can exploit this interface, creating an attractive target for attackers and researchers focusing on kernel security.
Discovered by Muhammad Alifa Ramdhan at STAR Labs during a kernel code audit for Google’s kernelCTF program, the flaw has been developed into a reliable local privilege escalation exploit. The research, conducted with Bing-Jhong Billy Jheng, secured a $113,337 reward for its submission.
Security Implications and Exploit Details
Listed by CISA as CVE-2025-39964, this vulnerability has been reported as actively exploited, underlining the urgency for patching. The core issue is a race condition in the AF_ALG’s sendmsg() handling, where concurrent writes can occur, leading to unauthorized modifications.
By manipulating the timing, attackers can maintain a merge flag while lacking valid entries in the final scatter-gather list, facilitating out-of-bounds access. This access can influence heap data, allowing attackers to craft a usercopy oracle and attain an arbitrary kernel write primitive.
Patch and Prevention Measures
Upstream Linux developers have addressed this flaw by implementing exclusive write ownership for AF_ALG contexts. The patch introduces a check on the write state, preventing concurrent writes from altering shared socket states.
Administrators are urged to update their systems with the patched kernel versions promptly. These include Linux 5.10.246, 5.15.195, 6.1.155, 6.6.109, 6.12.50, and 6.16.10. This update is crucial for environments where untrusted code execution is possible, such as shared Linux infrastructure and container hosts.
In conclusion, addressing this long-standing Linux kernel vulnerability is essential to maintaining system security and preventing potential exploits. Organizations should prioritize applying these patches to protect their infrastructures effectively.
