CVE-2025-39964: Linux Kernel: Güvenilmeyen Veri Yazma Açığı

Linux Kernel'de aynı sokete eş zamanlı yazma denemesi sistem tutarsızlığına yol açabilir. Saldırgan bu zafiyeti kullanarak sistemde beklenmedik davranışlara neden olabilir. Hemen en güncel Linux Kernel yamasına geçilmelidir.

Türkçe özet yapay zekâ ile üretildi.

Açıklama (NVD)

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

Özet bilgiler

Ürün

Linux Linux Kernel

CVSS v3.1

5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS

%1,61 (yüzdelik 76)

CWE

CWE-362

Yama

Mevcut

KEV

Eklenme: 2026-09-18 · Son tarih: 2026-09-21

Gerekli aksiyon: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• git.kernel.org
• git.kernel.org
• git.kernel.org
• git.kernel.org
• git.kernel.org
• git.kernel.org
• git.kernel.org
• cert-portal.siemens.com
• cert-portal.siemens.com
• www.cisa.gov
• CWE-362
• CISA KEV kataloğu