kernelCTF reward paid: $113,337.00 USD (Source: IDNSEC research publication, Muhammad Alifa Ramdhan (2026))
A Race Condition Fourteen Years in the Making
A researcher at STAR Labs has published a detailed account of how he found CVE-2025-39964, a Linux kernel vulnerability that let an ordinary, unprivileged user escalate to root — and, separately, escape a Docker container to obtain root on the underlying host. According to the account, published on IDNSEC, Muhammad Alifa Ramdhan discovered the flaw while auditing the kernel's AF_ALG subsystem, with colleague Bing-Jhong Billy Jheng helping complete the exploit chain. The bug was reported through Google's kernelCTF program, which rewards researchers for working exploits against the current stable kernel, rather than sold or disclosed informally.
Reachable From Any Unprivileged Process
AF_ALG is a kernel API that exposes cryptographic operations — encryption and decryption — directly to userspace programs through the standard socket interface, with no elevated privilege or special configuration required to reach it. The account describes the flaw as a race condition: when two threads share the same AF_ALG socket and one hits a wait state while the kernel's send buffer is full, the socket lock is briefly released, allowing the two threads' operations to interleave in a way the original code did not anticipate. That interleaving can leave an internal data structure in a state where the kernel reads memory outside the bounds of its intended array, which the researcher was able to convert from a crash into a controlled write and, ultimately, a path to root.
A Second, Unrelated AF_ALG Bug Drew Wider Notice
The article distinguishes CVE-2025-39964 from "Copy Fail," a separate AF_ALG vulnerability disclosed in 2026 that was later recognized alongside a bug called DirtyFrag for Best Privilege Escalation Bug at the 2026 Pwnie Awards. The two bugs sit in the same kernel subsystem but differ in mechanism: Copy Fail is described as a straight-line logic flaw in the AEAD code path, while CVE-2025-39964 is a race between concurrent writers on a shared socket. The researcher says he found the race while reviewing the AF_ALG source in September 2025, before Copy Fail's disclosure brought broader attention to the subsystem.
Why This Reaches Beyond the Kernel Team
Two features of this disclosure matter to anyone who signs off on infrastructure risk rather than patches it directly. First, the entry point required no special access — any process on a shared system could reach the vulnerable code path through a standard socket call, which is the profile that turns a local bug into a fleet-wide exposure once a working exploit circulates. Second, the same primitive that grants root inside a Linux host is described as sufficient to escape a Docker container, meaning organizations that rely on container boundaries as their primary isolation control were exposed at the kernel layer regardless of what ran inside the container.
What to Ask Your Team
Ask whether any workloads depend on container boundaries alone for isolation between tenants or environments, without additional hardening such as gVisor, Kata, or restrictive seccomp profiles — kernel-level privilege escalation bugs defeat that boundary by design. Ask when your kernel patching cadence last incorporated CVE-2025-39964 specifically, rather than assuming a general distribution update covered it. And ask whether your organization's vulnerability disclosure or bug bounty terms would make a researcher who found something like this report it to you first, rather than to a third-party program or a broker.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: idnsec.com.
