GPU VulnDB

Database/Kernel, userspace & hypervisor

Linux kernel af_alg: concurrent writes to one socket corrupt internal state, local denial of service

CVSS 5.5CVE-2025-39964Kernel, userspace & hypervisorKnown exploitedcurated

Impact

Two concurrent writes to the same AF_ALG socket interleave their data unpredictably and can leave the socket's internal state inconsistent; the fix adds a ctx->write ownership flag to reject the second writer. The rated outcome is availability only (CVSS 5.5, A:H, no confidentiality or integrity impact) and the trigger is local - a process that opens an AF_ALG socket and issues parallel sendmsg calls. On a shared GPU node any tenant process can open AF_ALG unless it is blocked, so the practical risk is a tenant crashing or hanging the host kernel and taking every other job on that node with it. There is no privilege escalation here and no remote path. If your nodes do not use the kernel crypto userspace API, a seccomp or LSM rule denying AF_ALG sockets removes the exposure outright.

Who can reach it

Local only. Any unprivileged local user or container process that is permitted to create an AF_ALG socket (AF_ALG is namespace-agnostic and reachable from a default container unless seccomp blocks socket(AF_ALG, ...)). No authentication beyond code execution on the node.

What to do

Pick up the stable kernel release containing the fix for your branch - the five git.kernel.org commits in the references are the backports across maintained trees. Installing a distribution kernel means draining the node and rebooting it, which for a GPU node costs a maintenance window per host; given a local availability-only impact, most operators will fold this into the next scheduled kernel roll rather than schedule one. Mitigation in the meantime: block AF_ALG socket creation from tenant workloads via the seccomp profile if the kernel crypto API is not in use.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-39964https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6cehttps://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84

Related entries

All Kernel, userspace & hypervisor entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.