14-Year-Old Linux Kernel Flaw Lets Local Users Gain Root Access and Escape Containers
Brief
A 14-year-old Linux kernel vulnerability can let a local attacker escalate to root privileges and, in a proof-of-concept environment, escape a Docker container to compromise the underlying host.
The flaw in Linux’s AF_ALG userspace cryptographic interface stems from unsafe concurrent writes to the same socket used for operations like AES encryption and decryption.
Because an unprivileged local process can access this interface, it presents a valuable attack surface for kernel researchers and attackers alike.
Security researcher Muhammad Alifa Ramdhan of STAR Labs discovered the issue in 2025 while auditing Linux kernel code for Google’s kernelCTF program.
The research, completed with colleague Bing-Jhong Billy Jheng, demonstrated that the bug could be developed into a reliable local privilege-escalation exploit. The kernelCTF submission reportedly received a $113,337 reward.