CISA alerts of active exploitation of three Linux kernel flaws
CISA ordered federal agencies to patch three actively exploited Linux kernel flaws, including 14-year-old CVE-2025-39964, by end of day.
CISA added three Linux kernel vulnerabilities to its KEV catalog and ordered federal agencies to apply updates by end of day, marking them for forensic triage. CVE-2025-39964 is a 14-year-old race condition in the AF_ALG cryptographic socket interface that can crash systems or alter cryptographic results; STAR Labs demonstrated privilege escalation and container escape in Google's kernelCTF. CVE-2026-53266 is an out-of-bounds write in ebtables SNAT with a known exploit per Red Hat, and CVE-2025-39682 is a kTLS receive-path flaw with public exploits available. No ransomware exploitation has been flagged for any of the three flaws.
- Three Linux kernel flaws actively exploited; federal patch deadline is today.
- CVE-2025-39964 race condition in AF_ALG lingered 14 years in kernel.
- Public exploits exist for CVE-2026-53266 and CVE-2025-39682.
- All three flaws marked for forensic triage on affected assets.
- No ransomware group exploitation flagged so far.
Coverage
oldest first · one row per article · UTC- · Sep 18, 2026
oss-securityFirst report
Re: A quartet of Linux local root vulns: DirtyAH6, PPPoEject, TUNderflow, and DiagSpill
oss-security follow-up on four Linux local root vulnerabilities—DirtyAH6, PPPoEject, TUNderflow, DiagSpill—debates distribution-specific patching challenges.
- · Sep 18, 2026
The Hacker News
Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root
Researcher Asim Manizada published working exploits for four patched Linux kernel flaws (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469) enabling local root access.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-45896 | ntfs3 in the Linux kernel through 6.8.0 allows a physically proximate attacker to read kernel memory by mounting a filesystem (e.g., if a Linux distribution is… | 7.1 | <1% | ||
| CVE-2025-39682 | Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoS | 9.8 | 3% | KEV | KEV |
| CVE-2025-39964 | Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg) | 5.5 | 2% | KEV | KEV |
| CVE-2025-54505 | A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor unit, potentially… | 2.0 | <1% | ||
| CVE-2026-53266 | Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge) | 8.8 | <1% | KEV | KEV |
| CVE-2026-68121 | Use-After-Free in Linux Kernel PPPoE Send Path Enables Local Root (PPPoEject) | 7.8 | <1% | PoC ×2 | |
| CVE-2026-74469 | Linux kernel: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit… | 8.8 | <1% | ||
| CVE-2026-80844 | Out-of-bounds memory access in Linux kernel AH6 (xfrm) enables local privilege escalation | — | <1% | PoC ×2 | |
| CVE-2026-81000 | Linux kernel TUN/TAP headroom integer underflow enables local memory corruption | 7.8 | <1% | PoC ×2 |