[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail

A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.

A deep dive into CVE-2024-27394, a TCP-AO use-after-free caused by incorrect RCU API usage in the Linux kernel, covering RCU internals, the patch, and the ExpRace technique for reliable triggering.

A 15-year-old Linux kernel stack use-after-free was turned into reliable local privilege escalation and container escape, affecting essentially every unpatched major distribution.

Copy Fail (CVE-2026-31431): an algif_aead flaw lets unprivileged users write 4 bytes into the page cache of any readable file via AF_ALG and splice(), escalating to root on kernels since 2017.

A new spin on the classic modprobe_path privilege-escalation technique after the kernel removed the dummy-file trigger: Frontier Squad reaches call_modprobe via AF_ALG sockets and fileless chaining.

The public PoC turns the kernel race into a reproducible local root-escalation chain. It requires specific kernel configuration and an isolated lab, but hosts exposing the relevant namespace, traffic-control, and module-loading capabilities should verify that the upstream fix or an equivalent backport is present.