14-Year-Old Linux Kernel Vulnerability Lets Attackers Gain Root and Escape Containers
Brief
A 14-year-old Linux kernel flaw in the AF_ALG cryptographic socket interface can allow unprivileged local users to gain root privileges and escape Docker containers.
Tracked as CVE-2025-39964, the vulnerability stems from a race condition in concurrent sendmsg() operations that can be converted into an out-of-bounds memory access and ultimately an arbitrary kernel write.
Security researcher Muhammad Alifa Ramdhan discovered the issue in 2025 while auditing Linux kernel attack surfaces for Google’s kernelCTF program.
14-Year-Old Linux Kernel Vulnerability
The research, completed with assistance from STAR Labs colleague Bing-Jhong Billy Jheng, produced a working local privilege-escalation exploit and earned a $113,337 kernelCTF reward.
The flaw predates the 2026 “Copy Fail” disclosure , which also involved AF_ALG but affected a different code path.