Linux Kernel AF_ALG Concurrent-Write Race Condition (Local Privilege Escalation + Container Escape)

#!/bin/bash
# CVE-2025-39964 Checker — AF_ALG concurrent-write race condition
# Checks running kernel version against known-fixed stable branches.
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

KERNEL=$(uname -r)
VERSION=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse kernel version from: $KERNEL"
  exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

# version_gte: returns 0 if $1.$2.$3 >= $4.$5.$6
version_gte() {
  local a1=$1 a2=$2 a3=$3 b1=$4 b2=$5 b3=$6
  if (( a1 > b1 )); then return 0; fi
  if (( a1 < b1 )); then return 1; fi
  if (( a2 > b2 )); then return 0; fi
  if (( a2 < b2 )); then return 1; fi
  if (( a3 >= b3 )); then return 0; fi
  return 1
}

echo "Kernel: $KERNEL (parsed: $MAJOR.$MINOR.$PATCH)"
echo "CVE: CVE-2025-39964 — AF_ALG concurrent-write race"
echo "Fix commit: 1b34cbbf4f01 (upstream 2025-09-16)"
echo "---"

# Fixed stable versions:
#   5.10.246, 5.15.195, 6.1.155, 6.6.109, 6.12.50, 6.16.10
# Kernels < 2.6.38 are NOT affected (feature did not exist).
# Kernels >= 6.17-rc7 / 6.17+ carry the fix.

if version_gte $MAJOR $MINOR $PATCH 6 17 0; then
  echo "PATCHED — kernel $VERSION is >= 6.17 (fix merged in 6.17-rc7)"
  exit 0
elif (( MAJOR == 6 && MINOR == 16 )); then
  if version_gte $MAJOR $MINOR $PATCH 6 16 10; then
    echo "PATCHED — kernel $VERSION is >= 6.16.10"
    exit 0
  fi
elif (( MAJOR == 6 && MINOR == 12 )); then
  if version_gte $MAJOR $MINOR $PATCH 6 12 50; then
    echo "PATCHED — kernel $VERSION is >= 6.12.50"
    exit 0
  fi
elif (( MAJOR == 6 && MINOR == 6 )); then
  if version_gte $MAJOR $MINOR $PATCH 6 6 109; then
    echo "PATCHED — kernel $VERSION is >= 6.6.109"
    exit 0
  fi
elif (( MAJOR == 6 && MINOR == 1 )); then
  if version_gte $MAJOR $MINOR $PATCH 6 1 155; then
    echo "PATCHED — kernel $VERSION is >= 6.1.155"
    exit 0
  fi
elif (( MAJOR == 5 && MINOR == 15 )); then
  if version_gte $MAJOR $MINOR $PATCH 5 15 195; then
    echo "PATCHED — kernel $VERSION is >= 5.15.195"
    exit 0
  fi
elif (( MAJOR == 5 && MINOR == 10 )); then
  if version_gte $MAJOR $MINOR $PATCH 5 10 246; then
    echo "PATCHED — kernel $VERSION is >= 5.10.246"
    exit 0
  fi
fi

# Check if kernel predates the vulnerable code (< 2.6.38)
if (( MAJOR < 2 )) || { (( MAJOR == 2 )) && (( MINOR < 6 )); } || \
   { (( MAJOR == 2 )) && (( MINOR == 6 )) && (( PATCH < 38 )); }; then
  echo "PATCHED — kernel $VERSION predates AF_ALG (introduced in 2.6.38)"
  exit 0
fi

# Check for distro-patched kernels (RHEL, Debian, Ubuntu often backport)
# Look for the actual fix in the kernel config/source
if [ -f /boot/config-$(uname -r) ]; then
  # If CONFIG_CRYPTO_USER_API is not set, AF_ALG is not available
  if ! grep -q 'CONFIG_CRYPTO_USER_API=y' /boot/config-$(uname -r) 2>/dev/null && \
     ! grep -q 'CONFIG_CRYPTO_USER_API=m' /boot/config-$(uname -r) 2>/dev/null; then
    echo "PATCHED — AF_ALG (CONFIG_CRYPTO_USER_API) is not enabled in this kernel"
    exit 0
  fi
fi

# Check for distro errata markers
if command -v rpm &>/dev/null; then
  RPM_KERNEL=$(rpm -q kernel-$(uname -r) 2>/dev/null || rpm -q kernel-core-$(uname -r) 2>/dev/null || true)
  if [ -n "$RPM_KERNEL" ]; then
    echo "NOTE: RPM kernel package: $RPM_KERNEL"
    echo "Check vendor errata (RHSA/ELSA/ALSA) for CVE-2025-39964 fix status."
  fi
elif command -v dpkg &>/dev/null; then
  DEB_KERNEL=$(dpkg -l 'linux-image-*' 2>/dev/null | grep "$(uname -r)" | awk '{print $2, $3}' || true)
  if [ -n "$DEB_KERNEL" ]; then
    echo "NOTE: Debian/Ubuntu kernel: $DEB_KERNEL"
    echo "Check DSA-6053-1 / DLA-4379-1 / USN advisories for fix status."
  fi
fi

echo "VULNERABLE — kernel $VERSION does not match any known-fixed stable version"
echo "Action: Apply vendor kernel update or livepatch immediately (KEV-listed, active exploitation)."
exit 1