Linux kernel flaw allows root access and Docker container escape

A long-standing vulnerability in the Linux kernel, identified as CVE-2025-39964, allows local users to escalate privileges to root and escape Docker containers to compromise host systems. The flaw exists within the AF_ALG userspace cryptographic interface and stems from a race condition involving unsafe concurrent writes to the same socket during operations such as AES encryption.

Discovered in 2025 by security researcher Muhammad Alifa Ramdhan of STAR Labs, alongside colleague Bing-Jhong Billy Jheng, the vulnerability had been present in the kernel since approximately 2011. The research was submitted to Google’s kernelCTF program, earning a reward of $113,337. The Cybersecurity and Infrastructure Security Agency (CISA) has listed the vulnerability among those reported as being exploited in the wild, highlighting the necessity for immediate patching.