Linux Kernel Race Condition Vulnerability

Linux Kernel

Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. Can be chained with CVE-2026-53266, CVE-2025-39682. Added to CISA KEV on 2026-09-18 (federal deadline 2026-09-21).

First seen: 18 Sept 2026
Last update: 18 Sept 2026, 12:00 UTC
Identifiers: CVE-2025-39682
CVE-2025-39964
CVE-2026-53266
Source: CISA KEV
On the menu as: Linux kernel

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Linux Kernel Race Condition Vulnerability
Severity: high, exploited in the wild. Patch status: patched.
Affected: Linux Kernel
Ids: CVE-2025-39682, CVE-2025-39964, CVE-2026-53266

Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. Can be chained with CVE-2026-53266, CVE-2025-39682. Added to CISA KEV on 2026-09-18 (federal deadline 2026-09-21).

## Steps
1. This touches infrastructure (linux). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2025-39682") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://git.kernel.org/stable/c/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce https://git.kernel.org/stable/c/153ea96c806aea395daba907a4f88480b6ad5093 https://git.kernel.org/stable/c/1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 https://git.kernel.org/stable/c/1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8 https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9 https://git.kernel.org/stable/c/45bcf60fe49b37daab1acee57b27211ad1574042 https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843 https://git.kernel.org/stable/c/67ba971ae02514d85818fe0c32549ab4bfa3bf49 https://git.kernel.org/stable/c/76280b78cc9f23bdc6438e10ad6dff148ef8375b https://git.kernel.org/stable/c/7c4491b5644e3a3708f3dbd7591be0a570135b84 https://git.kernel.org/stable/c/9aee87da5572b3a14075f501752e209801160d3d https://git.kernel.org/stable/c/afd64b59c3de9bbbdd3759e834fdc55cda716e0b https://git.kernel.org/stable/c/b18675263db1147c8e1cab625400c13a0d87bd2d https://git.kernel.org/stable/c/b7e91939ba9be805a62a257fa4e227dffbb88fa0 https://git.kernel.org/stable/c/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87 https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677 https://git.kernel.org/stable/c/c9b5ff59feffb92a147a84a5aa28acd2cb8ff4c5 https://git.kernel.org/stable/c/e4c1ec11132ec466f7362a95f36a506ce4dc08c9 https://nvd.nist.gov/vuln/detail/CVE-2025-39682 https://nvd.nist.gov/vuln/detail/CVE-2025-39964 https://nvd.nist.gov/vuln/detail/CVE-2026-53266
https://pwned.coffee/i/linux-kernel-race-condition-vulnerability

Sources

Totalone hot coffee