14-Year-Old Linux Kernel Flaw Lets Local Users Gain Root Access and Escape Containers

A 14-year-old Linux kernel vulnerability can let a local attacker escalate to root privileges and, in a proof-of-concept environment, escape a Docker container to compromise the underlying host.

The flaw in Linux’s AF_ALG userspace cryptographic interface stems from unsafe concurrent writes to the same socket used for operations like AES encryption and decryption.

Because an unprivileged local process can access this interface, it presents a valuable attack surface for kernel researchers and attackers alike.

Security researcher Muhammad Alifa Ramdhan of STAR Labs discovered the issue in 2025 while auditing Linux kernel code for Google’s kernelCTF program.

The research, completed with colleague Bing-Jhong Billy Jheng, demonstrated that the bug could be developed into a reliable local privilege-escalation exploit. The kernelCTF submission reportedly received a $113,337 reward.

CISA has also listed CVE-2025-39964 among vulnerabilities reported as exploited in the wild, increasing the urgency of patching.

14-Year-Old Linux Kernel Flaw

The underlying issue is a race condition in the AF_ALG sendmsg() handling path. Normally, the kernel collects cryptographic input across one or more requests and tracks those buffers using scatter-gather lists. A context flag named merge indicates that the final buffer has unused page space and that new data can be appended safely.

However, two threads can issue writes against the same AF_ALG operation socket. While the socket lock protects most state changes, the kernel releases that lock while a thread waits for writable buffer space. This permits another writer to modify the shared context before the original thread resumes.

According to IDNsec research, attackers can manipulate timing to leave ctx->merge enabled while the final scatter-gather list has no valid entries, causing a subsequent write to access metadata before the intended array via sg[-1].

That out-of-bounds access becomes dangerous because attacker-controlled heap data can influence the fake scatterlist metadata. Researchers used the condition to create a usercopy oracle and ultimately derive an arbitrary kernel write primitive. The exploit then overwrites core_pattern, a kernel setting that controls how Linux handles process core dumps.

When core_pattern begins with a pipe character, Linux executes the configured program as a core-dump handler. By replacing this value and crashing a child process, the proof of concept runs the attacker-controlled binary with root privileges.

Since containers share the host kernel, the same kernel-level primitive can enable a Docker container escape in affected configurations.

The vulnerable code was introduced with Linux 2.6.38 in 2011 and remained exposed for roughly 14 years. Affected versions include kernels before the fixed stable releases, subject to distribution backports. Public advisories identify fixed versions including Linux 5.10.246, 5.15.195, 6.1.155, 6.6.109, 6.12.50, and 6.16.10.

Upstream Linux developers fixed the problem by adding exclusive write ownership to AF_ALG contexts. The patch introduces a ctx->write state check, causing a second concurrent writer to fail rather than alter the socket’s shared state.

Administrators should promptly install their distribution’s patched kernel package and reboot into the updated kernel. Organizations should prioritize shared Linux infrastructure, container hosts, multi-user systems, and environments where untrusted local code or tenant workloads can execute.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC