CISA Highlights Linux Kernel AF_ALG Socket Flaw CVE-2025-39964

En bref

• CVE-2025-39964 affects the Linux kernel's AF_ALG socket interface.
• Impacts include interleaved data and unstable socket states.
• CISA directs agencies to apply mitigations and assess internet exposure.
• If mitigations are unavailable, discontinue use of the affected component.
• The number of vulnerable systems remains unspecified.

A medium-severity security issue in the Linux kernel's AF_ALG socket interface has been assigned CVE-2025-39964. The Cybersecurity and Infrastructure Security Agency (CISA) has drawn attention to this flaw, which can lead to data interleaving and inconsistent socket states. This means operations on the cryptographic socket could mix data or leave the socket in an unpredictable condition.

For K-12 IT administrators in New Brunswick, any Linux-based server, appliance, or endpoint that uses AF_ALG may be affected. AF_ALG is commonly employed for hardware-accelerated cryptography, so systems relying on it for encryption or secure communications could experience corrupted outputs or application crashes. The total scope of impacted devices is not yet known.

The potential for data interleaving raises concerns about information leakage or integrity failures, while inconsistent socket states might cause denial-of-service conditions. Even if direct exploitation is not observed, the instability alone can disrupt critical services. CISA's Binding Operational Directive 26-04 mandates specific actions for federal agencies; state and local education entities should consider mirroring those steps.

What to watch: Linux distributions are expected to release patches. Until then, evaluate whether any internet-facing services depend on AF_ALG. If mitigations are not available, discontinue use of the affected component. Monitor CISA and vendor advisories for updates, and prepare to test and deploy fixes as they arrive.

À faire maintenant

1. Inventory all Linux systems and determine which ones use AF_ALG sockets.
2. Apply available kernel patches or vendor mitigations as soon as they are released.
3. Evaluate whether any AF_ALG-dependent services are exposed to the internet.
4. If no mitigations exist, disable or discontinue the affected component.
5. Adhere to BOD 26-04 requirements for reporting and remediation timelines.
6. Monitor CISA and Linux distribution advisories for updates on CVE-2025-39964.
7. Test any fixes in a staging environment before deploying to production.

Source originale

CISA Known Exploited Vulnerabilities