CISA has warned that attackers are actively exploiting three Linux kernel flaws, including one critical vulnerability. The agency ordered US federal organisations to patch affected systems and conduct forensic checks.
CISA Adds Three Flaws to Exploited Vulnerability List
The US Cybersecurity and Infrastructure Security Agency added the three vulnerabilities to its Known Exploited Vulnerabilities catalogue.
Their severity ratings range from medium to critical. Moreover, one of the flaws remained in the Linux kernel for 14 years before researchers identified it.
CISA gave all three vulnerabilities its highest priority for federal agencies. It ordered those organisations to apply available updates and mitigations by September 21.
However, the agency has not disclosed details about the observed attacks. It has also withheld information about the threat actors exploiting the flaws.
Race Condition Enables Container Escape
The first vulnerability, CVE-2025-39964, affects the kernel’s AF_ALG cryptographic socket interface.
A race condition allows concurrent write operations to corrupt the state associated with a socket. Consequently, attackers could crash systems or alter cryptographic results.
Researchers from offensive security company STAR Labs discovered the issue. They said they found the flaw without assistance from an artificial intelligence system.
The team demonstrated the vulnerability through Google’s kernelCTF programme. During the demonstration, the researchers achieved privilege escalation and escaped from a container.
Ebtables Flaw Corrupts Shared Memory
CVE-2026-53266 affects the Linux kernel’s ebtables SNAT implementation.
The out-of-bounds write flaw occurs during an ARP address rewrite. It can modify shared file-backed memory before the system makes the affected packet range writable.
Red Hat has confirmed that a known exploit exists for the vulnerability.
Security researcher Kimmo Suominen also published a technical analysis and patch-status tracker. The analysis describes a potential privilege-escalation method involving changes to file-backed memory.
However, the researcher inferred the proposed attack chain by comparing the flaw with Dirty Pipe. Researchers have not publicly demonstrated that complete exploitation method.
Kernel TLS Bug Has Public Exploits
The third vulnerability, CVE-2025-39682, affects the Linux kernel’s TLS receive path.
The logic flaw incorrectly handles zero-length records that the system queues for later processing. As a result, the kernel may process different TLS record types together when systems use kTLS.
Public exploits already exist for this vulnerability. Red Hat has also confirmed their availability in its security guidance.
Federal Agencies Must Conduct Forensic Checks
CISA requires federal agencies to perform forensic triage on systems affected by the three vulnerabilities.
Therefore, administrators must do more than install security updates. They also need to examine every vulnerable asset for evidence of previous exploitation.
This requirement reflects the possibility that attackers may have compromised systems before organisations applied patches.
CISA has not linked any of the three Linux kernel flaws to ransomware attacks. Nevertheless, confirmed active exploitation and public technical details increase the urgency of patching.
Organisations outside the US federal government should also apply the available updates. In addition, security teams should review affected systems for suspicious activity.
0 responses to “CISA Warns Three Linux Kernel Flaws Face Active Attacks”