CVE-2025-39964: The $113,337 AF_ALG Linux Privilege Escalation Bug

STAR Labs researcher Muhammad Alifa Ramdhan discovered CVE-2025-39964, a race condition in the Linux kernel's AF_ALG cryptographic subsystem that lets an ordinary user escalate to root or escape a Docker container to gain host-level access. The bug arises from a race between writers sharing the same AF_ALG socket. With help from colleague Bing-Jhong Billy Jheng completing the exploit chain, the finding was responsibly disclosed and submitted to Google's kernelCTF program, earning a $113,337 reward.

AF_ALG exposes an encryption/decryption API reachable directly from unprivileged userspace via the standard socket interface, requiring no special privileges or configuration to reach kernel code — making it an attractive but previously unexplored kernelCTF attack surface. The vulnerable code had reportedly existed in the kernel since around 2011.

The bug is distinct from 'Copy Fail,' disclosed in 2026 and later honored alongside DirtyFrag for Best Privilege Escalation Bug at the 2026 Pwnie Awards: Copy Fail is a straight-line logic flaw in the AEAD path, whereas CVE-2025-39964 is a race condition, and was found in September 2025, before Copy Fail surfaced. Alongside precedents like Dirty COW and Dirty Pipe, the case underscores why kernel security researchers continue to prioritize auditing socket-reachable subsystems for privilege escalation flaws.