CVE-2025-39964VulnerabilityPublished 25 Sep 2026Updated 29 Oct 2026

Red Hat Security Advisory: kernel security update

Affects Linux kernelSource GCVE Database

Compare

Mentioned vulnerabilities

Exploited in the wild · KEV due 21 Sep 2026 · 1% EPSS : apply the vendor's fix or mitigations to Linux kernel now.

Data as of 29 Oct 2026, 07:26 UTC

Exploitation

Actively exploited

Critical severity · CVSS not yet scored by NVD

KEV deadline: 21 Sep 2026 US federal agencies must patch by this date; a sensible deadline for everyone else. Other KEV due dates
EPSS: 1.5% chance of exploitation in 30 days – higher than 75% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

t = 0 is the CVE’s publication on cve.org

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: evidence found.
Public exploit code: GitHub proofs of concept
Exploited in the wildExploited: evidence found.
Listed in CISA KEV 7 days before disclosure
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

Added to CISA KEV (opens in a new tab)
exploitation confirmed
18 Sep 2026, 7 days before disclosure
KEV remediation due
US federal deadline
21 Sep 2026, 4 days before disclosure
CVE published
on cve.org
25 Sep 202618:55 UTC, t = 0

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, CISA KEV (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 29 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Description

A critical security update for the Linux kernel in Red Hat Enterprise Linux for ARM 64 10 addresses multiple vulnerabilities including concurrent write issues in the crypto subsystem (af_alg), shared memory corruption in netfilter's ebtables SNAT target, and a use-after-free flaw in IPv6 routing rules. These vulnerabilities have been assigned CVE identifiers CVE-2025-39964, CVE-2026-53266, and CVE-2026-74581 respectively. The update requires a system reboot to take effect and is rated critical due to the kernel's fundamental role in system security.

Impact

The vulnerabilities affect the Linux kernel's core components, potentially allowing attackers to cause race conditions, memory corruption, or use-after-free conditions. Such flaws can lead to system crashes, privilege escalation, or other security breaches. The advisory rates the impact as critical and confirms known exploitation in the wild, emphasizing the urgency of patching.

Mitigation

A security update is available from Red Hat for the Linux kernel on Red Hat Enterprise Linux for ARM 64 10. Users should apply the update promptly following Red Hat's guidance at https://access.redhat.com/articles/11258 and reboot the system to activate the fixes. Red Hat strongly advises against delaying this update due to the critical nature of the vulnerabilities and confirmed exploitation in the wild.

Summary

This Red Hat security advisory covers a kernel update for Red Hat Enterprise Linux for ARM 64 10 that fixes three critical vulnerabilities: CVE-2025-39964 involves disallowing concurrent writes in af_alg_sendmsg to prevent race conditions in the crypto subsystem; CVE-2026-53266 addresses improper writes to shared memory pages by the ebtables SNAT target during ARP hardware address rewriting; and CVE-2026-74581 fixes a use-after-free in the IPv6 fib6_rule_suppress function caused by a stale pointer. These flaws could impact system stability and security. The advisory recommends applying the update and rebooting the system to ensure protection.

CWE-366Race Condition within a Thread (opens in a new tab)
Base weaknessLikelihood of exploit: Medium
If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
Architecture and Design
Use locking functionality. This is the recommended solution. Implement some form of locking mechanism around code which alters or reads persistent data in a multithreaded environment.
Architecture and Design
Create resource-locking validation checks. If no inherent locking mechanisms exist, use flags and signals to enforce your own blocking scheme when resources are being used by other threads of execution.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.2 (opens in a new tab)
Attack patterns
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
Leveraging Race Conditions (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-825Expired Pointer Dereference (opens in a new tab)
Base weakness
The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
Architecture and Design
Choose a language that provides automatic memory management.
Implementation
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-416Use After Free (opens in a new tab)
Variant weaknessLikelihood of exploit: HighCWE Top 25 (2025): #7
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Architecture and Design · Language Selection
Choose a language that provides automatic memory management.
Implementation · Attack Surface Reduction
When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization (opens in a new tab)
Class weaknessLikelihood of exploit: MediumOWASP Top 10 A06:2025: Insecure Design (opens in a new tab)
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Architecture and Design
In languages that support it, use synchronization primitives. Only wrap these around critical code to minimize the impact on performance.
Architecture and Design
Use thread-safe capabilities such as the data access abstraction in Spring.
Architecture and Design
Minimize the usage of shared resources in order to remove as much complexity as possible from the control flow and to reduce the likelihood of unexpected conditions occurring.
OWASP Cheat Sheets
Abuse Case (opens in a new tab)
Secure Design Principles (opens in a new tab)
OWASP ASVS 4.0.3
V1.11.2 (opens in a new tab)
Attack patterns
Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions (opens in a new tab)
Leveraging Race Conditions (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

Timeline

What to do

Description

AI analysisMachine-generated, updated 29 Oct 2026, 07:26 UTC

Public exploits and detectionGitHub proofs of concept

WeaknessesCWE-366, CWE-825, CWE-416 +1

Technical details

References

Community reviews

Related threats