Status: KEV | Advisory ID: CVE-2025-39964
| CVE | CVE-2025-39964 |
| CVSS | CVSS 7.8 (High): attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high. (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) |
| Affected products | Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Firmware, and Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Firmware |
| Exploitation status | Listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed active exploitation. |
| Classified as | CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')) |
| KEV listing | Added to CISA's Known Exploited Vulnerabilities (KEV) catalog on 2026-09-18. |
| Federal remediation deadline | 2026-09-21 (CISA KEV, Binding Operational Directive). |
In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
Issuing two writes to the same af_alg socket is bogus as the
data will be interleaved in an unpredictable fashion. Furthermore,
concurrent writes may create inconsistencies in the internal
socket state.
Disallow this by adding a new ctx->write field that indiciates
exclusive ownership for writing.
| Source | Reference |
|---|---|
| NVD | https://nvd.nist.gov/vuln/detail/CVE-2025-39964 |