CVE-2025-39964 patch guidance is now urgent because CISA added the Linux kernel AF_ALG race condition to its Known Exploited Vulnerabilities catalog on September 18, 2026. CISA lists a September 21 remediation deadline for covered federal systems and requires forensic triage under BOD 26-04. For other organizations, the KEV addition is a strong patch-prioritization signal, but it does not mean every Linux installation is affected or that CISA has disclosed the attack chain.
Direct answer: administrators should identify the kernel actually running on each system, check that exact distribution and release against the vendor’s CVE advisory, install the vendor-supported fixed kernel package, reboot or otherwise activate the new kernel when required, and then verify the running kernel again. Do not rely on a generic upstream version number alone because Linux distributions backport fixes into their own package versions.
What changed with CVE-2025-39964?
The vulnerability itself was already known and patched upstream. The new information-state change is that CISA now lists CVE-2025-39964 in KEV, meaning the agency has evidence of exploitation in the wild.
That changes patch priority materially. Older vulnerability pages or cached summaries that describe the issue as not known exploited or not present in KEV are now stale.
What is CVE-2025-39964?
CVE-2025-39964 is a race condition in the Linux kernel’s AF_ALG cryptographic socket path. Concurrent writes to the same AF_ALG socket can interleave in a way that leaves internal socket state inconsistent.
The upstream Linux security assessment currently classifies the attack vector as local, with low privileges required and no user interaction. That distinction matters: CISA confirms exploitation, but the reviewed evidence does not support describing CVE-2025-39964 as a direct remote network vulnerability.
Is CVE-2025-39964 a privilege-escalation vulnerability?
The upstream Linux analysis describes technical primitives that can support serious confidentiality, integrity and availability impact and can be useful in privilege-escalation scenarios. However, CISA’s KEV entry does not disclose the actual exploitation chain used in the wild.
TPS therefore does not describe the observed campaign as a confirmed privilege-escalation campaign. The technical capability and the real-world exploit chain are separate evidence questions.
Why do some pages show different severity scores?
The Linux CNA currently rates CVE-2025-39964 at CVSS 3.1 7.8 High, using a local attack vector, low privileges, no user interaction and high confidentiality, integrity and availability impact. Some distro and NVD-facing pages still show lower scores or different vendor priorities.
Administrators should not decide whether to patch solely from one CVSS number. CISA’s KEV inclusion confirms exploitation, while distro-specific advisories determine whether a particular supported package is affected and which update fixes it.
CVE-2025-39964 patch: which upstream kernel branches contain the fix?
Current Linux and OSV metadata identifies fixed branch points including:
- 5.10.245
- 5.15.194
- 6.1.154
- 6.6.108
- 6.12.49
- 6.16.9
These are upstream stable-branch reference points. They should not be treated as universal package instructions for Ubuntu, Debian, Amazon Linux, Oracle Linux, SUSE, Red Hat or another vendor. Distribution kernels frequently backport the security fix while keeping a different package version.
How should I check whether my Linux system is affected?
Record the kernel currently active on the host, not only the newest package installed on disk.
Determine the vendor, product line and release because affected and fixed package versions vary.
Compare your exact package against the vendor’s current CVE-2025-39964 status rather than inferring exposure from a generic upstream version.
Use the distribution-supported update path. Do not replace an enterprise distro kernel with an arbitrary upstream kernel only to match a branch number.
Reboot or follow the vendor’s supported activation procedure where required.
After activation, confirm that the running kernel/package matches or exceeds the vendor’s fixed version for your product.
What do Linux vendors currently report?
Ubuntu: current Ubuntu security data marks Ubuntu 26.04 LTS and 25.10 as not affected and lists a fixed package for Ubuntu 25.04 at 6.14.0-37.37. Ubuntu currently assigns its own priority separately from the Linux CNA’s 7.8 score.
Debian: Debian’s tracker lists fixed package versions across supported releases, including Bookworm 6.1.158-1, Bullseye 5.10.247-1 and Trixie 6.12.57-1 in the reviewed state.
Amazon Linux: Amazon’s security tracker shows fixed update paths for AL2023 and supported Amazon Linux 2 kernel lines, while some older tracks can show no fix planned.
Oracle Linux: Oracle rates the issue Important and lists UEK errata across supported Oracle Linux generations.
SUSE: SUSE’s product matrix is mixed, with some product lines released or fixed, others still in progress and some older or LTSS lines remaining affected.
Red Hat: Red Hat’s current vulnerability record describes the AF_ALG race and presently assigns its own vendor severity. TPS did not recover a complete supported-RHEL fixed-package matrix during the reviewed research.
Does container use matter?
Potentially. The upstream attack analysis says the vulnerable AF_ALG path can be reachable by an unprivileged local user in relevant environments, including contexts involving user namespaces or containers.
This does not mean every container automatically makes the host exploitable. Exposure still depends on the host kernel, configuration and runtime environment. The host kernel remains the key remediation target because containers share the host kernel unless a different virtualization boundary is used.
What does CISA require by September 21?
CISA lists September 21, 2026 as the due date for this KEV entry for covered federal systems. The KEV record also marks forensic triage as required under BOD 26-04.
Private organizations are not automatically subject to the federal deadline, but many vulnerability-management teams use KEV inclusion as a high-priority signal because it indicates observed exploitation rather than theoretical exploitability alone.
Should administrators perform forensic triage?
For covered federal environments, CISA’s KEV record requires forensic triage. Other organizations should make incident-response decisions according to their own risk, exposure and security policy.
No CVE-specific public indicators of compromise, threat-actor attribution or exploitation campaign pattern were identified in the reviewed evidence. TPS therefore does not recommend inventing a log signature or assuming that one generic kernel message proves compromise.
Is ransomware using CVE-2025-39964?
CISA currently lists known ransomware use as Unknown. That is not the same as confirmed ransomware use and should not be presented as one.
What does successful remediation look like?
Successful remediation is more than downloading a kernel package. The important state is that the host is actually running a vendor-supported kernel that contains the fix.
After installation and any required reboot, administrators should re-check the running kernel and compare it with their distribution’s current CVE advisory. Systems that cannot be patched immediately should follow vendor guidance and the organization’s vulnerability-management and incident-response controls rather than assuming the local attack vector makes the risk negligible.
What remains unknown?
- CISA has not publicly disclosed the threat actor or campaign responsible for exploitation.
- The initial-access vector and full exploitation chain are not established in the reviewed public evidence.
- No CVE-specific public IOC set was identified.
- CISA does not currently confirm ransomware use.
- Exposure and fixed package versions vary across Linux distributions and supported product lines.
What happens next?
The next material checkpoint is September 21, CISA’s federal remediation deadline. Further CISA notes, vendor advisories, exploit-chain disclosure, public indicators, campaign attribution or changed distro package status should update this same page rather than create another CVE-2025-39964 URL.
Verification note: ThePulseSignal reviewed the CISA KEV state, upstream Linux vulnerability records, OSV branch-fix data and current vendor security status from Ubuntu, Debian, Amazon Linux, Oracle Linux, Red Hat and SUSE. CISA’s exploitation confirmation is established; the public exploit chain, actor, ransomware use and exhaustive distro package matrix remain unresolved.