suominen/cve-2025-39964Patch-status tracker for CVE-2025-39964, a Linux AF_ALG race condition enabling local privilege escalation, recording per-distribution fix availability.
Source for the CVE-2025-39964 patch-status tracker: a single-page site recording which distributions have shipped a fix for a race condition in the Linux kernel's AF_ALG cryptographic socket API, exploitable by a local user for kernel memory corruption and privilege escalation.
Everything about the bug — affected and fixed versions, the upstream fix commit, discovery and disclosure credit, exploitation status, and current per-distribution patch status — belongs to the tracker page, not to this README:
site/content/_index.mdEdit that file; everything else in this repo is build infrastructure.
None of it is restated here on purpose. The tracker page is revised as distributions ship fixes — twice daily by the auto-update agent while the tracker is live — so any copy kept in this README would silently rot. Resist re-adding a summary.
Deployment plan and current setup state live in WEBSITE.md.
Requires Hugo ≥ 0.146.0 (the standard edition suffices: no Sass or image processing in this site) and Go (for Hugo Modules to fetch the PaperMod theme).
nix develop # dev shell: hugo, go, resvg + fonts, and every lookup tool
cd site
hugo server # local preview at http://localhost:1313/CVE-2025-39964/
If you use direnv, direnv allow once and the dev
shell auto-activates whenever you cd into the repo.
make build # local build into site/public/
make dist # build, then rsync to haig:/CVE-2025-39964/
make banner # re-rasterise the social banner SVG → PNG (needs resvg + the banner fonts)
make dist runs make build first. make banner is only needed after
editing site/assets/cve-2025-39964-tracker.svg; the rendered PNG is
committed.
CC BY 4.0 — share and adapt with attribution.