CISA alerts of active exploitation of three Linux kernel flaws

Summary

CISA has issued an alert regarding the active exploitation of three Linux kernel vulnerabilities, one of which is rated critical. These flaws, ranging in severity, have been added to CISA's Known Exploited Vulnerabilities catalog, requiring federal agencies to apply updates and mitigations. One vulnerability, CVE-2025-39964, has been present for 14 years and has been demonstrated to achieve privilege escalation and container escape.

Full text

CISA alerts of active exploitation of three Linux kernel flaws By Bill Toulas September 21, 2026 04:12 PM 0 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical. The three security issues were added separately last week and have severity ratings ranging from medium to critical. One of them, tracked as CVE-2025-39964, existed in the Linux kernel for 14 years. CISA marked all three flaws with the highest priority for federal agencies, ordering them to apply available security updates and mitigations by the end of today. The three vulnerabilities are: CVE-2025-39964: a race condition in the kernel’s AF_ALG cryptographic socket interface that allows concurrent writes to corrupt per-socket state and potentially crash systems or alter cryptographic results. CVE-2026-53266: an out-of-bounds write vulnerability in the Linux kernel’s ebtables SNAT implementation that can cause an ARP address rewrite to modify shared file-backed memory without first making the affected packet range writable. CVE-2025-39682: a Linux kernel TLS receive-path logic flaw that mishandles zero-length records queued for later processing, potentially allowing different TLS record types to be processed together when kTLS is in use. CISA says [1, 2] the vulnerabilities have been exploited in attacks but has not revealed any details about the incidents or the nature of the threat actors. Offensive security company STAR Labs found CVE-2025-39964, saying that its researchers found the issue with no help from an AI system. They demonstrated the vulnerability by achieving privilege escalation and container escape in Google’s kernelCTF. For CVE-2025-39682, there are public exploits available, as also confirmed by Red Hat in its security bulletin. Red Hat also confirmed a known exploit available for CVE-2026-53266. Researcher Kimmo Suominen has published a technical analysis and patch-status tracker for CVE-2026-53266 on GitHub, outlining a potential privilege-escalation path involving modifications to file-backed memory. However, the researcher notes that the proposed exploitation chain is inferred by analogy with Dirty Pipe and has not been demonstrated with public exploit code. CISA has marked all three flaws as requiring “forensic triage.” This means that for every affected asset, federal agencies need to examine it for signs that exploitation already occurred. Currently, none of the three flaws is flagged as exploited by ransomware groups. Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Save your seat Related Articles: CISA orders urgent patching of actively exploited Zimbra flawCritical Progress LoadMaster flaw now actively exploited in attacksCisco warns of FMC static credential flaw exploited in zero-day attacksCheck Point warns of SmartConsole zero-day exploited in attacksCISA orders urgent action on actively exploited Langflow RCE flaw

Indicators of Compromise

• cve — CVE-2025-39964
• cve — CVE-2026-53266
• cve — CVE-2025-39682

Entities