Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.
NVD: In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
Issuing two writes to the same af_alg socket is bogus as the
data will be interleaved in an unpredictable fashion. Furthermore,
concurrent writes may create inconsistencies in the internal
socket state.
Disallow this by adding a new ctx->write field that indiciates
exclusive ownership for writing.
Hunt kernel audit logs and dmesg for crashes in af_alg_sendmsg from crypto/af_alg.c; look for local processes issuing concurrent sendmsg() on AF_ALG sockets, which signals race-condition exploitation causing kernel oops or corrupted crypto.
Research details
Componentaf_alg_sendmsg handler in crypto/af_alg.c
PreconditionsLocal user access to the target system is required; the af_alg kernel module must be loaded (enabled by default on most Linux distributions); the attacker must be able to open an AF_ALG socket via the crypto user API and issue concurrent sendmsg() calls from two or more threads to the same socket. agent
DeliveryLocal - requires ability to open AF_ALG sockets via the crypto user API and issue concurrent sendmsg() calls
Exploit notesCVSS attack complexity: LOW | No public exploit or PoC code identified; exploitation requires local access and concurrent sendmsg() calls on the same AF_ALG socket from multiple threads to trigger the race condition
SummaryA race condition in the Linux kernel's AF_ALG crypto user API allows concurrent writes to the same socket via af_alg_sendmsg, causing interleaved data and inconsistent internal socket state. A local attacker could crash the system or corrupt cryptographic operation results. The fix introduces exclusive write ownership via ctx->write. Patched in kernel stable releases across all supported branches; Red Hat recommends blacklisting the af_alg module as a mitigation.
Tia coverage
First reported2026-09-04
First exploit report2026-09-19
Exploit report → KEV1 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.