Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities

Summary

CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating federal agencies to patch them within three days. The vulnerabilities, tracked as CVE-2025-39682, CVE-2025-39964, and CVE-2026-53266, allow attackers to cause denial-of-service conditions, disclose memory, or modify memory. While CISA has not disclosed specific exploitation details, the inclusion on the KEV list indicates active exploitation.

Full text

The Cybersecurity and Infrastructure Security Agency has expanded its Known Exploited Vulnerabilities (KEV) catalog with three Linux kernel flaws, urging federal agencies to immediately patch them. Tracked as CVE-2025-39682 (CVSS score of 9.8), the first of the bugs is a critical-severity issue impacting the kernel’s handling of zero-length records on the rx_list in the TLS receive path. This is a corner case where the recvmsg() logic – each recvmsg() call processes either DATA or non-DATA records – breaks out of the processing loop when an initial zero-length record is pulled from rx_list. When zero-copy decryption occurs, the kernel decrypts ciphertext into a user-space buffer. Because zero-copy is permitted only with DATA records, the vulnerable function assumes that no type change can occur after the zero-copy, but the logic can be broken using a zero-length record originating from rx_list. A local attacker could exploit this improper check for unusual or exceptional conditions to cause a denial-of-service (DoS) condition or trigger memory disclosure. The second vulnerability, CVE-2025-39964 (CVSS score of 7.8), is described as a race condition: issuing two writes to the same AF_ALG socket leads to data being interleaved in an unpredictable fashion.Advertisement. Scroll to continue reading. An attacker could trigger the security defect to create inconsistencies in the socket’s internal state, leading to system crashes or corrupted cryptographic operation results, which could cause DoS conditions. The third Linux kernel flaw newly added to CISA’s KEV list is CVE-2026-53266 (CVSS score of 8.8), an out-of-bounds write issue in the bridge Netfilter ebtables Source Network Address Translation (SNAT) target. Under certain conditions, an Address Resolution Protocol (ARP) sender hardware address is written directly into a nonlinear socket-buffer fragment, causing memory corruption. An attacker can trigger the unsafe write with a crafted packet containing an ARP payload, leading to unauthorized memory modification outside the intended packet buffer. CISA has not shared details on the exploitation of the three vulnerabilities, but told federal agencies they should patch all three within three days. Related: Microsoft Patches 18 Vulnerabilities in AI, Cloud Products Related: Critical Orkes Conductor Vulnerability Exploited in Attacks Related: Check Point, Kaspersky, Tanium Patch Product Vulnerabilities Related: ISC Patches 14 Vulnerabilities in BIND 9 Security Update Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Critical Orkes Conductor Vulnerability Exploited in AttacksMIND Secures $72 Million for AI-Powered DLPRevolut Data Breach: 5 Months, 680 High-Profile Accounts, $3M RansomComp AI Raises $34 Million for AI-Native Compliance and SecurityISC Patches 14 Vulnerabilities in BIND 9 Security UpdateCisco Fixes Dozens of Flaws Across FMC, ISE and Nexus DashboardCISA Releases Cyber Decoy Guidance to Strengthen Critical Infrastructure DefensesActive Exploitation Triggers Emergency Patch for Cisco ISE Zero-Day Latest News Google Confirms Gemini AI Breached Three FirmsTigerByte Cyber Emerges From Stealth With $3 Million in FundingIn Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP FlawAI-Built Exploit and Sign-In Flaw Opened Path to Internal OpenAI Code23 Million User Records Compromised in Gyazo Data Breach Microsoft Patches 18 Vulnerabilities in AI, Cloud ProductsNightmareStresser DDoS Service Disrupted in International OperationBrevo Supply Chain Attack Injects Malware Into 100,000 Websites Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Building Continuous Authorization at Scale September 23, 2026 Explore what it takes to operationalize continuous authorization at scale, including the technical, organizational, and cultural changes required. Register People on the MoveVeritas Capital has appointed Joel Fulton as Chief Information Security Officer.incident.io has appointed Carlos Gonzalez-Cadenas as Chief Operating Officer.Ruben D. Chacon has joined ADM as Vice President and Global CISO.More People On The MoveExpert Insights “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2025-39682
• cve — CVE-2025-39964
• cve — CVE-2026-53266

Entities