CISA alerts of active exploitation of three Linux kernel flaws
CISA says three Linux kernel flaws, one critical, are actively exploited and due for federal fixes today.
CISA warned that three Linux kernel vulnerabilities are being exploited and ordered federal agencies to patch and mitigate by the end of September 21, 2026, with forensic triage required. Severities range from medium to critical. CVE-2025-39964 is a 14-year-old AF_ALG race condition that STAR Labs used for privilege escalation and container escape in Google's kernelCTF. CVE-2026-53266 is an ebtables SNAT out-of-bounds write, and CVE-2025-39682 is a kTLS receive-path flaw; Red Hat says public exploits exist for both. CISA has not named actors, and none is flagged as ransomware use.
- All three flaws have CISA's highest federal priority and a same-day deadline.
- CVE-2025-39964 remained in the kernel for 14 years.
- STAR Labs demonstrated privilege escalation and container escape in kernelCTF.
- Red Hat confirms public exploits for CVE-2025-39682 and CVE-2026-53266.
- Agencies must forensically triage assets for signs of prior exploitation.
- Products
- Linux kernel
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-39682 | Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoS | 9.8 | 3% | KEV | KEV |
| CVE-2025-39964 | Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg) | 5.5 | 2% | KEV | KEV |
| CVE-2026-53266 | Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge) | 8.8 | <1% | KEV | KEV |
From the original article
2 min read at bleepingcomputer.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical.
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.