CISA has warned that attackers are actively exploiting three Linux kernel vulnerabilities, ranging from medium to critical severity, and has ordered federal agencies to apply patches or mitigations immediately after adding the flaws to its Known Exploited Vulnerabilities (KEV) catalog.

The Three Flaws

  • CVE-2025-39964: A race condition in the kernel’s AF_ALG cryptographic socket interface. Concurrent writes can corrupt per-socket state, potentially crashing systems or altering cryptographic results. The bug reportedly existed in the kernel for 14 years.
  • CVE-2026-53266: An out-of-bounds write in the kernel’s ebtables SNAT implementation. An ARP address rewrite can modify shared file-backed memory without first making the affected packet range writable.
  • CVE-2025-39682 (CVSS 9.8): An improper handling flaw in the kernel’s TLS receive path. It mishandles zero-length records queued for later processing, potentially allowing different TLS record types to be processed together when kTLS is in use.

CISA has not disclosed details about the attacks or the threat actors behind them, but has flagged all three vulnerabilities as requiring forensic triage, meaning agencies must check affected systems for evidence that exploitation already took place. None of the three flaws is currently linked to ransomware activity.

Exploit Availability

CVE-2025-39964 was discovered by offensive security firm STAR Labs, which said its researchers found the issue without AI assistance and demonstrated privilege escalation and container escape using Google’s kernelCTF.

Red Hat’s security bulletin confirms public exploits exist for CVE-2025-39682 and a known exploit is available for CVE-2026-53266. Researcher Kimmo Suominen has published a technical analysis and patch-tracking resource for CVE-2026-53266 on GitHub, outlining a possible privilege-escalation path involving modification of file-backed memory. Suominen notes this exploitation chain is inferred by analogy to the previously known Dirty Pipe vulnerability and has not been demonstrated with working public exploit code.

What Defenders Should Do

Federal agencies were required to apply updates or mitigations by the end of the day the advisory was issued. Given the CVSS 9.8 rating on the TLS flaw and confirmed public exploit code for two of the three bugs, organizations running affected Linux kernel versions, particularly those using kTLS or ebtables SNAT configurations, should prioritize patching and review logs for signs of prior compromise.