14-Year-Old Linux Kernel Vulnerability Enables Root Access and Docker Escape

Severity

High

CVE-2025-39964 is a long-standing race-condition vulnerability in the Linux kernel’s AF_ALG cryptographic interface. The flaw originated in Linux kernel 2.6.38, released in 2011, and remained undetected for approximately 14 years until it was discovered in 2025 by STAR Labs researchers. The vulnerability can allow an unprivileged local attacker to escalate privileges to root and potentially escape a Docker container to the underlying host.

AF_ALG provides user-space applications with access to kernel cryptographic functions through standard sockets. The vulnerability exists in the af_alg_sendmsg() function, where concurrent write operations can cause inconsistent state within the shared af_alg_ctx structure. The issue was successfully exploited by researchers, earning a $113,337 reward from Google.

How?

An attacker can exploit a race condition by performing concurrent sendmsg() operations on the same AF_ALG socket. When one operation is forced to wait for socket memory, the kernel releases the socket lock, allowing another write operation to proceed simultaneously.

By carefully timing these operations and triggering a failed userspace copy, the attacker can cause the kernel to incorrectly set internal state and access sg[-1], resulting in an out-of-bounds memory access. Through heap manipulation and repeated probing, the attacker can turn this condition into a controlled kernel memory write.

The researchers demonstrated that the write could be redirected to the kernel’s core_pattern configuration. By modifying it to execute their payload when a process crashes, they were able to execute code with root privileges. Since Docker containers share the host kernel, this technique can potentially be used to escape a container and gain root access to the underlying host.

Recommendation

Organizations should update affected Linux kernels to versions containing the fix. Recommended fixed versions include 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, and 6.16.9, or the corresponding security updates provided by the Linux distribution. Administrators should also inventory both host and container environments, prioritize systems running multi-tenant or containerized workloads, and restrict access to AF_ALG where operationally feasible until kernel updates are applied.

Source

https://gbhackers.com/14-year-old-linux-kernel-vulnerability/

https://idnsec.com/research/linux-local-privilege-escalation-with-af-alg/