14-Year-Old Linux Kernel Flaw Grants Root Access, Enables Docker Container Escape
A critical vulnerability in the Linux kernel’s AF_ALG cryptographic interface, present for 14 years, allows an unprivileged local attacker to escalate privileges to root and escape Docker containers. Tracked as CVE-2025-39964, the flaw was discovered in 2025 by STAR Labs researcher Muhammad Alifa Ramdhan, with exploitation assistance from Bing-Jhong Billy Jheng. Their work earned a $113,337 reward from Google as part of a Linux kernel CTF submission.
The vulnerability stems from a race condition in the af_alg_sendmsg() function, which manages concurrent socket writes. While the kernel’s lock_sock() mechanism initially appears to serialize access, it releases the lock during memory waits, enabling two threads to interfere with the same socket. A carefully timed exploit can manipulate the af_alg_ctx structure, leading to an out-of-bounds memory access when cur is set to zero. Attackers can then heap-spray adjacent memory to redirect writes, ultimately overwriting the core_pattern file a kernel-controlled path that executes as root when a process crashes.
By replacing core_pattern with a malicious command and triggering a child process crash, the researchers demonstrated root execution on the host. Since Docker containers share the host kernel, the exploit also enables container escape, granting full control over the underlying system.
The flaw originated in Linux 2.6.38 (2011) and remained unpatched until 2025, when fixes were released in stable kernel versions 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, and 6.16.9. The patch enforces exclusive write ownership via ctx->write, blocking concurrent sendmsg() operations with an EBUSY error.
CISA added CVE-2025-39964 to its Known Exploited Vulnerabilities catalog on September 18, 2026, highlighting the need for immediate patching. The vulnerability affects systems where AF_ALG is accessible, including default Docker configurations, making internet-facing and multi-tenant environments particularly high-risk.
Source: https://gbhackers.com/14-year-old-linux-kernel-vulnerability/
Docker, Inc cybersecurity rating report: https://www.rankiteo.com/company/docker
"id": "DOC1790346409",
"linkid": "docker",
"type": "Vulnerability",
"date": "9/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'location': 'Global',
'type': 'Organizations using Linux systems or Docker '
'containers'}],
'attack_vector': 'Local',
'date_detected': '2025',
'date_publicly_disclosed': '2025',
'date_resolved': '2025',
'description': 'A critical vulnerability in the Linux kernel’s AF_ALG '
'cryptographic interface, present for 14 years, allows an '
'unprivileged local attacker to escalate privileges to root '
'and escape Docker containers. Tracked as CVE-2025-39964, the '
'flaw was discovered in 2025 by STAR Labs researcher Muhammad '
'Alifa Ramdhan, with exploitation assistance from Bing-Jhong '
'Billy Jheng. The vulnerability stems from a race condition in '
'the `af_alg_sendmsg()` function, enabling out-of-bounds '
'memory access and root execution via manipulation of the '
'`core_pattern` file. The flaw affects systems where AF_ALG is '
'accessible, including default Docker configurations.',
'impact': {'operational_impact': 'Full system compromise, container escape, '
'root access',
'systems_affected': 'Linux systems (versions 2.6.38 to pre-patched '
'5.10.245, 5.15.194, 6.1.154, 6.6.108, '
'6.12.49, 6.16.9), Docker containers'},
'investigation_status': 'Resolved (patched)',
'lessons_learned': 'Long-standing kernel vulnerabilities can remain '
'undetected for years, posing significant risks to '
'multi-tenant and containerized environments. Immediate '
'patching is critical for high-risk vulnerabilities.',
'post_incident_analysis': {'corrective_actions': 'Kernel patch enforcing '
'exclusive write ownership '
'via `ctx->write` to prevent '
'concurrent `sendmsg()` '
'operations.',
'root_causes': 'Race condition in '
'`af_alg_sendmsg()` function due to '
'improper lock handling during '
'memory waits, leading to '
'out-of-bounds memory access and '
'privilege escalation.'},
'recommendations': 'Apply Linux kernel patches (5.10.245, 5.15.194, 6.1.154, '
'6.6.108, 6.12.49, 6.16.9) immediately. Restrict AF_ALG '
'access in Docker configurations. Monitor for unauthorized '
'privilege escalation attempts.',
'references': [{'source': 'STAR Labs Research'},
{'source': 'Google CTF Submission'},
{'date_accessed': '2026-09-18',
'source': 'CISA Known Exploited Vulnerabilities Catalog'}],
'regulatory_compliance': {'regulatory_notifications': 'CISA Known Exploited '
'Vulnerabilities '
'catalog (September 18, '
'2026)'},
'response': {'containment_measures': 'Kernel patches released (5.10.245, '
'5.15.194, 6.1.154, 6.6.108, 6.12.49, '
'6.16.9)',
'remediation_measures': 'Enforced exclusive write ownership via '
'`ctx->write` to block concurrent '
'`sendmsg()` operations',
'third_party_assistance': 'Google (CTF reward), STAR Labs '
'researchers'},
'title': '14-Year-Old Linux Kernel Flaw Grants Root Access, Enables Docker '
'Container Escape',
'type': 'Privilege Escalation, Container Escape',
'vulnerability_exploited': 'CVE-2025-39964 (Race condition in AF_ALG '
'cryptographic interface)'}