CISA alerts of active exploitation of three Linux kernel flaws
CISA says three Linux kernel flaws, one critical, are actively exploited and due for federal fixes today.
CISA warned that three Linux kernel vulnerabilities are being exploited and ordered federal agencies to patch and mitigate by the end of September 21, 2026, with forensic triage required. Severities range from medium to critical. CVE-2025-39964 is a 14-year-old AF_ALG race condition that STAR Labs used for privilege escalation and container escape in Google's kernelCTF. CVE-2026-53266 is an ebtables SNAT out-of-bounds write, and CVE-2025-39682 is a kTLS receive-path flaw; Red Hat says public exploits exist for both. CISA has not named actors, and none is flagged as ransomware use.
- All three flaws have CISA's highest federal priority and a same-day deadline.
- CVE-2025-39964 remained in the kernel for 14 years.
- STAR Labs demonstrated privilege escalation and container escape in kernelCTF.
- Red Hat confirms public exploits for CVE-2025-39682 and CVE-2026-53266.
- Agencies must forensically triage assets for signs of prior exploitation.
Vulnerabilities mentionedAll →
- CVE-2025-396829.83%Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoSpublished · Linux Kernel KEV
Full article408 words · extracted from bleepingcomputer.com · click to collapse
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical.
The three security issues were added separately last week and have severity ratings ranging from medium to critical. One of them, tracked as CVE-2025-39964, existed in the Linux kernel for 14 years.
CISA marked all three flaws with the highest priority for federal agencies, ordering them to apply available security updates and mitigations by the end of today.
The three vulnerabilities are:
- CVE-2025-39964: a race condition in the kernel’s AF_ALG cryptographic socket interface that allows concurrent writes to corrupt per-socket state and potentially crash systems or alter cryptographic results.
- CVE-2026-53266: an out-of-bounds write vulnerability in the Linux kernel’s ebtables SNAT implementation that can cause an ARP address rewrite to modify shared file-backed memory without first making the affected packet range writable.
- CVE-2025-39682: a Linux kernel TLS receive-path logic flaw that mishandles zero-length records queued for later processing, potentially allowing different TLS record types to be processed together when kTLS is in use.
CISA says [1, 2] the vulnerabilities have been exploited in attacks but has not revealed any details about the incidents or the nature of the threat actors.
Offensive security company STAR Labs found CVE-2025-39964, saying that its researchers found the issue with no help from an AI system. They demonstrated the vulnerability by achieving privilege escalation and container escape in Google’s kernelCTF.
For CVE-2025-39682, there are public exploits available, as also confirmed by Red Hat in its security bulletin. Red Hat also confirmed a known exploit available for CVE-2026-53266.
Researcher Kimmo Suominen has published a technical analysis and patch-status tracker for CVE-2026-53266 on GitHub, outlining a potential privilege-escalation path involving modifications to file-backed memory.
However, the researcher notes that the proposed exploitation chain is inferred by analogy with Dirty Pipe and has not been demonstrated with public exploit code.
CISA has marked all three flaws as requiring “forensic triage.” This means that for every affected asset, federal agencies need to examine it for signs that exploitation already occurred.
Currently, none of the three flaws is flagged as exploited by ransomware groups.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.