Long-lived Linux kernel flaw permits root container escape

A Linux kernel vulnerability present since 2011 can allow an unprivileged local attacker to gain root privileges and escape a Docker container, according to new technical research detailing an exploit for the flaw.

Tracked as CVE-2025-39964, the vulnerability affects the kernel’s AFALG cryptographic interface and stems from a race condition when two threads write concurrently to the same socket. Linux kernel maintainers fixed the issue in 2025 by preventing simultaneous writers from sharing an AFALG socket.

Muhammad Alifa Ramdhan, a principal vulnerability researcher at STAR Labs, disclosed fresh technical details on September 24 showing how the flaw can be converted from inconsistent socket state into an out-of-bounds memory access and, ultimately, a controlled kernel write. Ramdhan said he discovered the vulnerability while auditing Linux kernel attack surfaces in September 2025.

The vulnerable code was introduced in Linux 2.6.38, released in 2011. The Linux kernel CVE team said the defect could cause data from simultaneous writes to be interleaved unpredictably while leaving the socket’s internal state inconsistent. Its patch adds exclusive write ownership so only one writer can execute sendmsg() at a time.

AF_ALG is a userspace interface to cryptographic functions implemented by the Linux kernel. Programs can open sockets for operations such as symmetric encryption, hashing and authenticated encryption without requiring elevated privileges. That accessibility also means an ordinary local process can reach the vulnerable code path.

The kernel’s security assessment says exploitation requires local access but no special capability beyond low privileges and no user interaction. An attacker controls both sides of the race using two threads on a socket it owns. The assessment says an unprivileged user, including one inside a container or unprivileged user namespace, can open, bind and write to the relevant AF_ALG socket.

Ramdhan’s exploit manipulates the kernel’s scatter-gather structures used to hold cryptographic input. Under normal operation, AF_ALG serialises access with a socket lock. When a writer waits for send-buffer space, however, the lock is temporarily released, allowing another thread to alter the shared context before the first resumes.

By carefully controlling that sequence, the exploit can leave a flag indicating that data should be merged while the final scatter-gather list contains no valid entry. A subsequent write can then reference memory outside the intended array. The Linux kernel’s CVSS analysis says the resulting condition can expose arbitrary kernel memory and provide a controlled kernel write suitable for privilege escalation.

STAR Labs said the completed exploit obtains root from an unprivileged account and can also break out of a Docker container to secure root privileges on the host. The vulnerability was submitted through Google’s kernelCTF programme, which rewards working local privilege-escalation exploits against supported kernels. Ramdhan said the submission received a $113,337 reward, with colleague Billy Jheng Bing-Jhong credited for helping complete the exploit chain.

The flaw is not remotely exploitable through the network. An attacker must already be able to execute code locally, or within a container that can access the AF_ALG interface. That distinction limits the initial attack surface but makes the issue relevant to shared Linux systems and containerised environments where untrusted workloads run with restricted privileges.

Kernel maintainers backported fixes across multiple stable branches. The CVE announcement lists corrected releases including 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9, while Linux 6.17 contains the fix in its mainline history. Maintainers recommend upgrading to the latest stable kernel rather than cherry-picking individual commits.

The CVE announcement was issued on October 13, 2025, after the fixes had entered kernel lines. It identified the original introducing commit and warned that the list of unaffected releases could change as patches were backported. The kernel project also advised users to consult the CVE record because support status and fixed versions evolve across stable branches.