Sysprobs Sysprobs

CISA KEV entry

CVE-2025-39964Linux Kernel Race Condition Vulnerability

Linux Kernel. Added to the CISA Known Exploited Vulnerabilities catalogue on 18 September 2026.

Data status: a source is stale

Last synced CISA catalogue version 2026.11.04 (released 4 November 2026) 1,768 entries Updated manually

Date added
2026-09-18
Federal due date
2026-09-21 3 days after it was added; passed at the sync of 2026-11-05
Known ransomware use
Unknown
Forensic triage (BOD 26-04)
Yes
CVSS
5.5 Medium CVSS 3.1, scored by nvd@nist.gov
EPSS
1.60% percentile 75.9, scored 2026-11-04
CISA SSVC
Exploitation active, automatable no, technical impact total
NVD status
Analyzed published 2025-10-13, 340 days before the KEV listing

BOD 26-04 remediation window

With CISA's SSVC answers for this CVE (automatable: no, technical impact: total), BOD 26-04 Table 1 gives 3 days and forensic triage on a publicly exposed asset (row 3) and 14 days on an asset that is not publicly exposed (row 11) S06. CISA set the catalogue due date at 3 days; under BOD 26-04 it reflects CISA's own view of whether the flaw sits on publicly exposed assets S07. The directive binds US federal civilian executive branch agencies only.

What CISA says

Short description

Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.

Required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Notes

This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce; https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9; https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8; https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84; https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d; https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042; https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-39964

CWE in the catalogue

CWE-362

NVD details

CWE (NVD)
CWE-362 by nvd@nist.gov
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS versions in NVD
V31
Last modified in NVD
2026-10-19T21:10:00.160

Where each value comes from

Source and fetch time of every field on this page
FieldSourceFetched, UTCState
Catalogue fieldsCISA KEV JSON, version 2026.11.042026-11-05 11:38current
NVD published, status, CVSS, CWE, vendor linksNVD CVE API 2.0; CVSS: NVD (nvd@nist.gov)2026-11-03 12:37current at 2026-11-05 11:38
EPSSFIRST EPSS API, scores of 2026-11-042026-11-05 11:38current
CISA SSVCCISA ADP (via NVD), record of 2026-09-182026-11-03 12:37current

This product uses data from the NVD API but is not endorsed or certified by the NVD. CISA does not endorse Sysprobs. Methodology.

Back to the CISA KEV tracker · All 32 Linux entries