CISA Warns of Linux Kernel Vulnerabilities Actively Exploited in Attacks
CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV with a September 21 federal patching deadline.
CISA added CVE-2025-39682 (CVSS 9.8, improper condition check in the kernel TLS receive path affecting kTLS-enabled TCP sockets), CVE-2026-53266 (CVSS 8.8, out-of-bounds write in netfilter bridge ebtables SNAT), and CVE-2025-39964 (CVSS 7.8, race condition in AF_ALG) to its Known Exploited Vulnerabilities catalog on September 18, 2026. Binding Operational Directive 26-04 requires federal civilian agencies to remediate by September 21 and perform forensic triage for evidence of compromise. The most severe flaw is remotely triggerable on internet-accessible services using kTLS, while the other two require local access and can enable denial of service or privilege escalation. CISA has not attributed the exploitation or identified attackers or victims, but KEV inclusion confirms real-world exploitation.
- CVE-2025-39682: critical kTLS receive-path flaw allowing zero-length records to bypass recvmsg() type handling
- CVE-2026-53266: out-of-bounds write in ebtables SNAT ARP rewriting enabling memory corruption and privilege escalation
- CVE-2025-39964: AF_ALG race condition letting concurrent sendmsg() writes corrupt crypto socket state
- BOD 26-04 mandates patching by September 21 plus forensic triage of potentially exposed federal systems
- Mitigations include disabling kTLS, removing ARP-rewriting SNAT rules, restricting CAP_NET_ADMIN, and blocking af_alg
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-39682 | Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoS The Linux kernel's in-kernel TLS (kTLS) implementation mishandles zero-length records on the rx_list: each recvmsg() call must process either contiguous DATA records or a single non-DATA record, and the missed corner case occurs when the initial record is pulled from the rx_list and is zero length, breaking the check on record-type changes after zero-copy decryption. A local, low-privileged attacker able to use kTLS sockets can trigger this flaw, and the CVSS vector indicates high confidentiality impact (kernel information disclosure) and high availability impact (crash/DoS), with no integrity impact. Any Linux deployment running a kernel with the TLS (kTLS) feature enabled is affected, including Debian systems, which are listed as affected vendors in CISA's data. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation in the wild, though no public proof-of-concept is known and ransomware use is unconfirmed. Do: Update the Linux kernel to a release containing the upstream fix for this kTLS rx_list issue, applying Debian security updates where applicable, consistent with CISA BOD 26-04 patching guidance. As an interim mitigation, check whether kernel TLS is active (e.g., 'lsmod | grep tls' or CONFIG_TLS in the running kernel) and unload/disable the tls module on hosts that do not require kTLS. Limit local unprivileged access on multi-user systems, since exploitation requires a local low-privileged user. | 7.1 | 1% | KEV |
| mass≈100M+ systems potentially exposed (Linux kernel ubiquitous; only hosts with the kTLS module enabled and in use are vulnerable) | |
| CVE-2025-39964 | Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg) CVE-2025-39964 is a race condition (CWE-362) in the Linux kernel's AF_ALG crypto socket interface: the af_alg_sendmsg function did not prevent concurrent writes to the same socket, so two simultaneous writes could interleave data unpredictably and leave the kernel's internal socket state inconsistent. It is triggered by a local user (or local process) issuing concurrent write/sendmsg operations on the same AF_ALG socket, which is why the CVSS v3.1 score is low (3.3, local vector, low availability impact). An attacker exploiting the race primarily gains the ability to corrupt socket state, with potential for degraded availability; confidentiality and integrity are not rated as impacted. Any Linux kernel deployment whose build includes the vulnerable af_alg code is affected, though exploitation requires the ability to run local code that uses the crypto socket API. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation in the wild per CISA, but no public proof-of-concept is known and ransomware use is unknown; EPSS estimates a 0.3% probability of exploitation in the next 30 days. Do: Apply a kernel update from your distribution or vendor that includes the upstream fix 'crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg'; CISA KEV requires mitigating per BOD 26-04 guidance, so prioritize internet-exposed and multi-user systems. Because the vector is local, reduce exposure by limiting untrusted local code execution and auditing hosts that expose crypto-socket workloads; verify the fix by confirming your running kernel includes the af_alg_sendmsg exclusive-ownership patch. | 5.5 | <1% | KEV |
| massorder of billions of Linux-based systems (servers, Android devices, embedded/appliance kernels) ship the affected mainline kernel code | |
| CVE-2026-53266 | Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge) CVE-2026-53266 is an out-of-bounds write (CWE-787) in the Linux kernel's netfilter bridge ebtables SNAT target: when the optional ARP sender-hardware-address rewrite is active, the kernel writes the new MAC address via skb_store_bits() without first making that byte range writable. If the ARP sender hardware address bytes sit in a nonlinear skb fragment backed by a splice-imported file page, the write maps the fragment page and copies the MAC directly into a file-backed page-cache page, corrupting kernel-managed memory. A local, low-privileged attacker (for example a container tenant, VM, or user able to send traffic into a bridge using ebtables SNAT with ARP rewriting) can trigger this with crafted ARP packets, gaining kernel memory corruption usable for privilege escalation or integrity/availability impact (CVSS 3.1 8.8, scope changed). Any Linux system running a kernel with the vulnerable ebtables SNAT code in a bridged-networking configuration that performs this ARP rewrite is affected; the source data does not state specific affected version ranges. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation, although EPSS is low (0.1%, 2nd percentile) and no public proof-of-concept is known. Do: Update the kernel via your vendor's stable/security channel to a build that includes the upstream fix 'netfilter: bridge: make ebt_snat ARP rewrite writable', prioritizing internet-exposed and multi-tenant hosts in line with CISA BOD 26-04. Audit bridges, routers, gateways and virtualization hosts for ebtables SNAT rules that rewrite ARP sender hardware addresses and remove or disable those rules as an interim mitigation where patching is not yet possible. Restrict untrusted local/guest access to systems using ebtables bridging until patched. | 8.8 | <1% | KEV |
| mass≈ billions of devices ship the affected kernel code across distributions, servers, cloud, Android and embedded; realistically exploitable hosts (bridges with… |
Full article692 words · extracted from cybersecuritynews.com · click to collapse
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting three Linux kernel vulnerabilities, creating an urgent patching and investigation deadline.
CISA added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its Known Exploited Vulnerabilities catalog on September 18, 2026, with remediation required by September 21 under Binding Operational Directive 26-04.
The KEV catalog tracks vulnerabilities exploited in real-world attacks, while BOD 26-04 requires covered federal civilian agencies to accelerate remediation based on operational risk.
CISA also marked all three vulnerabilities as requiring forensic triage, meaning affected agencies must investigate potentially exposed assets for evidence of compromise rather than treating patch installation as the only response activity.
Linux Kernel Vulnerabilities Actively Exploited
The most severe issue, CVE-2025-39682, is a critical improper-condition check in the Linux kernel’s Transport Layer Security receive path. The CVE record assigns it a CVSS score of 9.8 and describes a corner case in which a zero-length record retrieved from the rx_list bypasses intended recvmsg() record-type handling. Subsequent TLS records could therefore be processed using incorrect zero-copy and queuing assumptions.
The flaw is relevant when kernel TLS, commonly called kTLS, is enabled and attached to TCP sockets. Red Hat says the affected code path can be triggered remotely when this functionality is used, making internet-accessible services employing kTLS a particularly important remediation priority.
At the source-code level, the vulnerability breaks an important receive-path rule: one recvmsg() operation should process either contiguous data records or a single non-data record. When the initial queued record has zero length, the type-transition check may be skipped, potentially producing unsafe socket-buffer state.
Upstream stable-kernel patches are available, but administrators should use distribution-provided kernel packages containing the fix instead of assessing exposure solely through generic version numbers.
CVE-2026-53266 is a high-severity out-of-bounds write vulnerability in the netfilter bridge ebtables SNAT target, carrying a CVSS score of 8.8. During an optional Address Resolution Protocol sender hardware-address rewrite, the kernel may call skb_store_bits() without ensuring the destination range is writable. If that data remains in a nonlinear socket-buffer fragment backed by a splice-imported file page, the operation can write directly into the underlying page.
Red Hat warns that a local attacker targeting a system configured with specific bridge netfilter rules could trigger memory corruption, denial of service, or potential privilege escalation. The upstream correction ensures that the ARP sender hardware-address range is writable before the kernel reads the ARP header and performs the modification.
CVE-2025-39964 is a race condition in the kernel’s AF_ALG cryptographic interface. Concurrent writes to the same AF_ALG socket can become unpredictably interleaved and leave its internal state inconsistent.
The vulnerability carries a CVSS score of 7.8, with its vector indicating a local, low-privilege attack path and potentially high confidentiality, integrity, and availability impact. The fix adds exclusive write ownership so only one writer can use sendmsg() at a time.
CISA has not publicly identified the attackers, victims, or exploitation techniques associated with these incidents, and ransomware involvement remains unknown. The lack of campaign details does not reduce the risk because KEV inclusion confirms that exploitation has occurred in the wild.
Organizations should install vendor-provided kernel updates, reboot into the corrected kernel, and verify the active version afterward. Where patches are unavailable, CISA advises applying vendor mitigations, following cloud-specific BOD 26-04 guidance, or discontinuing unsupported products.
Temporary protections may include disabling unused kTLS functionality, removing ARP-rewriting ebtables SNAT rules, restrictingCAP_NET_ADMIN, or preventing the af_alg module from loading after carefully evaluating operational impact.
Before remediation, security teams should preserve relevant telemetry and inspect exposed systems for kernel crashes, suspicious privilege changes, unexpected namespace activity, and unauthorized netfilter modifications.
With the September 21 deadline approaching, defenders should combine rapid patching with forensic assessment to determine whether vulnerable Linux systems were compromised before fixes were deployed.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Guru Baranhttps://cybersecuritynews.com
Gurubaran KS is a cybersecurity analyst, and Journalist with a strong focus on emerging threats and digital defense strategies. He is the Co-Founder and Editor-in-Chief of Cyber Security News, where he leads editorial coverage on global cybersecurity developments.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/linux-kernel-vulnerabilities-actively-exploited/