Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities
CISA added three exploited Linux kernel flaws to its KEV catalog, ordering federal agencies to patch within three days.
CISA expanded its Known Exploited Vulnerabilities catalog with three Linux kernel flaws and told federal agencies to patch within three days. CVE-2025-39682 (CVSS 9.8) is a critical flaw in TLS receive-path handling of zero-length records enabling DoS or memory disclosure; CVE-2025-39964 (CVSS 7.8) is an AF_ALG socket race condition causing crashes or corrupted cryptographic results; CVE-2026-53266 (CVSS 8.8) is an out-of-bounds write in the ebtables SNAT target triggered by a crafted ARP packet. CISA has not shared exploitation details.
- CVE-2025-39682: TLS zero-length record handling, CVSS 9.8
- CVE-2025-39964: AF_ALG write race condition, CVSS 7.8
- CVE-2026-53266: ebtables SNAT OOB write via ARP packet, CVSS 8.8
- All three added to CISA KEV as exploited
- Federal patch deadline set at three days
- ATT&CK
- T1499 Endpoint DoS
- Products
- Linux kernelebtablesAF_ALG
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-39682 | Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoS | 9.8 | 3% | KEV | KEV |
| CVE-2025-39964 | Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg) | 5.5 | 2% | KEV | KEV |
| CVE-2026-53266 | Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge) | 8.8 | <1% | KEV | KEV |
From the original article
2 min read at securityweek.com
Attackers could exploit the flaws to cause denial-of-service conditions, disclose memory, or modify memory. The post Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.