race-condition LPE in AF_ALG distinct from Copy Fail bug
How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail (external)
A race condition any unprivileged user can trigger through the AF_ALG socket API gives root on the host and escapes Docker containers, and it sat in Linux kernel crypto code for roughly 14 years.
- CVE-2025-39964, found by Muhammad Alifa Ramdhan at STAR Labs with Billy (Bing-Jhong) Jheng completing the chain, earned $113,337 as a Google kernelCTF submission; reported as the first kernelCTF entry using AF_ALG as the entry point.
- Distinct from the 2026 Copy Fail bug (a straight-line AEAD logic flaw): this is a race between two threads calling sendmsg() on the same AF_ALG socket, where lock_sock() is released during af_alg_wait_for_wmem() via sk_wait_event(), letting thread B resume into state thread A changed.
- The interleaving plus a deliberately failing memcpy_from_msg() (invalid user address) forces ctx->merge==true while the final af_alg_tsgl has cur==0, so sg = sgl->sg + sgl->cur - 1 computes sg[-1], an out-of-bounds read of a fake scatterlist 8 bytes before the 4096-byte object.
Full summary
A STAR Labs researcher documents CVE-2025-39964, a local privilege escalation in the Linux kernel's AF_ALG cryptographic socket interface, reachable from unprivileged userspace with no special configuration. The bug is a race: af_alg_sendmsg() releases the socket lock while waiting for send-buffer space (via sk_wait_event inside af_alg_wait_for_wmem), so two writers sharing one af_alg_ctx can interleave. Combined with a deliberately failing copy, this produces the supposedly impossible state ctx->merge==true with the final af_alg_tsgl's cur==0, making sgl->sg + sgl->cur - 1 point to sg[-1], an out-of-bounds fake scatterlist. Heap spraying controls sg[-1].page_link, which feeds the memcpy_from_msg() destination and yields a kernel write; because that path uses raw_copy_from_user with fault-tolerant exception handling, sendmsg's success-or-EFAULT return becomes a non-crashing oracle to locate pages despite KASLR. The exploit overwrites core_pattern with a pipe command to run the exploit binary as root, and because AF_ALG is reachable inside containers against the host kernel, it also escapes Docker to host root. The vulnerable code dated to 2011 (commit 8ff590903d5f, Linux 2.6.38); the upstream fix enforces exclusive writer ownership, returning -EBUSY to a second concurrent writer. The submission earned $113,337 via Google kernelCTF, distinct from the separate 2026 Copy Fail AEAD logic flaw.