How I Found a $113,337 AF_ALG Linux Local Privilege Escalati...

[carlospolop]

Blog URL

https://starlabs.sg/blog/2026/09-how-i-found-a-113337-af_alg-linux-local-privilege-escalation-before-copy-fail

Blog Title

How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail

Blog high summary

Overview and impact. CVE-2025-39964 is a Linux kernel local privilege-escalation vulnerability in the AF_ALG userspace cryptography interface, specifically the skcipher input path. An ordinary unprivileged local user can reach AF_ALG through the socket API, trigger a race between concurrent writers sharing one operation socket, corrupt the AF_ALG scatter-gather state, turn the resulting out-of-bounds access into a kernel write primitive, overwrite…

1. Break a persistent state invariant with concurrent writers. In a stateful kernel interface that stores fragmented input across calls, identify an invariant such as merge == true implying that the final list object contains at least one valid element. Trigger two writes on the same operation object while the socket is blocked on memory. If the wait path releases…

PR changes

• src/binary-exploitation/linux-kernel-exploitation/af-alg-concurrent-writer-scatterlist-oob.md: Added the AF_ALG concurrent-writer race, scatterlist underflow, heap-layout constraints, and usercopy oracle, with links to the distinct Copy Fail technique and existing core-handler coverage.

Errors

mdbook build unavailable

[carlospolop]

Decision: keep

The original exploit write-up and research article support the race, heap-layout constraint, and usercopy oracle; related book pages do not already cover them. The layout paragraphs now cite the researcher's explicit field-offset analysis rather than conflicting prose in the kernelCTF notes. Relative links resolve, citations and preserved examples were checked, and git diff --check passed.…

Head: 1affcaba99168744f0db7807e62d3cd7d9fe1e4e

[carlospolop]

merge