CISA Warns Three Linux Kernel Flaws Are Under Active Exploitation

Summary

CISA says attackers are exploiting three Linux kernel flaws, including a critical 14-year-old vulnerability. Federal agencies must patch and conduct forensic triage; incident details have not been disclosed.

Key points

CISA says all three vulnerabilities are being exploited, but has not disclosed incident details or identified the threat actors.
CVE-2025-39964 is a critical race condition in the AF_ALG interface; STAR Labs demonstrated privilege escalation and container escape in Google’s kernelCTF.
CVE-2026-53266 affects ebtables SNAT and can cause an out-of-bounds write to shared file-backed memory.
CVE-2025-39682 is a flaw in the Linux kernel TLS receive path; public exploits are available, according to Red Hat.
Red Hat also confirmed a known exploit for CVE-2026-53266, but a proposed privilege-escalation chain has not been demonstrated with public exploit code.
CISA directed federal agencies to apply available updates or mitigations and perform forensic triage on affected assets by the end of the day.

Article Details

Vulnerability Types: Race condition in the AF_ALG cryptographic socket interface
Out-of-bounds write in the ebtables SNAT implementation
TLS receive-path logic flaw involving zero-length records in kTLS
Severity: Severity ratings range from medium to critical; CVE-2025-39964 is rated critical.
Exploitation Status: active
Exploit Availability: public_exploit
Patch Status: available