[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail

Write-up of CVE-2025-39964, an AF_ALG race condition in the Linux kernel enabling an out-of-bounds scatterlist write. The exploit overwrites core_pattern for root and a Docker container escape.

The author used AI to find a UAF bug in Linux net/sched and built an LPE exploit for CentOS 9 at TyphoonPwn 2026. AI sped things up, but deep subsystem knowledge still mattered.

Exploiting CVE-2023-36802, a type confusion in Microsoft's mskssrv.sys driver, without the usual shortcuts: no NtQuery* leaks or PreviousMode read/write, only what works under current mitigations.

Ubuntu Server silently puts the first user in the lxd group, root-equivalent by design. The seeded lxd-installer socket lets lxd users install LXD password-free and reach host root; vendor won't fix.

The authors reverse-engineered Chrome's January 2026 fix for CVE-2026-0899, an out-of-bounds access in V8, built a trigger PoC, and defeated a stubborn CHECK to reach arbitrary read/write.

A new spin on the classic modprobe_path privilege-escalation technique after the kernel removed the dummy-file trigger: Frontier Squad reaches call_modprobe via AF_ALG sockets and fileless chaining.