A critical race condition vulnerability in the Linux kernel is currently being actively exploited in the wild, posing a severe risk to system integrity and stability.

This is a race condition vulnerability within the af_alg cryptographic socket implementation. An attacker with local access can trigger concurrent writes to the same socket, resulting in unpredictable data interleaving and corruption of internal kernel memory states.

The ability to manipulate kernel memory states via a race condition provides a significant vector for local privilege escalation or system instability. Given the CVSS score of 9.5 and confirmed active exploitation in the wild, this vulnerability represents an immediate threat to the confidentiality, integrity, and availability of any affected Linux system. Successful exploitation could allow an attacker to gain elevated privileges or force a denial of service.

Immediate Action: Update the Linux kernel to version 5.10.245, 5.15.194, 6.1.154, or 6.6.108 immediately to incorporate the necessary concurrency controls.

Proactive Monitoring: Review system audit logs for unusual kernel-level activity or repeated crashes associated with cryptographic socket operations.

Compensating Controls: Restrict access to local shell environments and limit the ability of untrusted users to interact with advanced socket interfaces where possible.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository n1k0oowang/CVE-2025-39964_EXP.

Due to the critical nature of this vulnerability and the evidence of active exploitation, immediate patching is required. Organizations must prioritize the deployment of the provided kernel updates across all affected environments to prevent potential compromise. Failure to act quickly significantly increases the risk of unauthorized privilege escalation and system disruption.