CISA Flags Linux Kernel AF_ALG Race Condition for Patching

En bref

• Linux kernel AF_ALG sockets have a race condition involving concurrent writes.
• CISA lists the issue in its Known Exploited Vulnerabilities catalog.
• Affected organizations should follow vendor mitigations and BOD 26-04 risk-based patching.
• Internet-facing Linux systems and cloud workloads need priority review.

A Linux kernel race condition tracked as CVE-2025-39964 has been added to CISA's Known Exploited Vulnerabilities catalog. The flaw involves AF_ALG sockets, a kernel interface used for cryptographic operations. When multiple writes occur against the same socket at the same time, data can be interleaved unpredictably and leave the socket's internal state inconsistent.

Organizations running Linux kernels that expose AF_ALG may be affected. For K-12 districts, this can include Linux-based servers, virtualization hosts, security appliances, VPN gateways, and cloud workloads. Any internet-facing system where AF_ALG is reachable should be treated as higher priority, because exposure increases the chance of exploitation or instability.

Kernel-level race conditions matter because they can lead to crashes, data corruption, or unpredictable system behavior. CISA's KEV listing indicates known exploitation, although the provided facts do not describe specific attack techniques. The required action is to apply mitigations according to vendor instructions and follow BOD 26-04 guidance for risk-based security updates and forensics triage where applicable.

Cloud services require special attention. If mitigations are unavailable, BOD 26-04 guidance says to follow applicable cloud service guidance or discontinue use of the product. Districts should also evaluate each asset's internet exposure and ensure patching decisions align with BOD 26-04 priorities.

What to watch: vendor kernel updates, Linux distribution advisories, cloud provider notices, and CISA KEV updates. Administrators should verify the CVE record in NVD and avoid relying on temporary workarounds alone. Patching and exposure reduction remain the most direct risk controls.

À faire maintenant

1. Inventory all Linux-based systems and record kernel versions, including servers, appliances, virtual hosts, and cloud instances.
2. Apply vendor-supplied kernel updates or mitigations as soon as they are available, prioritizing internet-facing assets.
3. Check cloud provider guidance for affected Linux images and managed services, and apply provider-recommended actions.
4. If AF_ALG is not required, restrict access to it using available kernel or module controls after testing for operational impact.
5. Monitor CISA KEV, NVD, and Linux distribution advisories for updated exploitation details and patching deadlines.
6. Follow BOD 26-04 risk-based patching and forensics triage requirements for any suspected compromise or exposed asset.
7. Document mitigation status and verify that updates have been applied across all affected systems.

Source originale

CISA Known Exploited Vulnerabilities