CISA Orders Federal Agencies to Patch Three Actively Exploited Linux Kernel Flaws
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are actively exploiting three Linux kernel vulnerabilities, with severity ratings ranging from medium to critical. CISA marks all three flaws with the highest priority for federal agencies and orders them to apply available security updates and mitigations by the end of today. One of the vulnerabilities, tracked as CVE-2025-39964, has existed in the Linux kernel for 14 years.
The three vulnerabilities include CVE-2025-39964, a race condition in the kernel's AF_ALG cryptographic socket interface that allows concurrent writes to corrupt per-socket state and potentially crash systems or alter cryptographic results. CVE-2026-53266 is an out-of-bounds write vulnerability in the kernel's ebtables SNAT implementation that can cause an ARP address rewrite to modify shared file-backed memory without first making the affected packet range writable. CVE-2025-39682 is a TLS receive-path logic flaw that mishandles zero-length records queued for later processing, potentially allowing different TLS record types to be processed together when kTLS is in use.
CISA says the vulnerabilities have been exploited in attacks but does not reveal details about the incidents or the threat actors involved. Offensive security company STAR Labs discovers CVE-2025-39964 and demonstrates it by achieving privilege escalation and container escape in Google's kernelCTF. Public exploits are available for CVE-2025-39682 and a known exploit exists for CVE-2026-53266, both confirmed by Red Hat. CISA requires forensic triage for all affected assets, meaning federal agencies need to examine them for signs that exploitation has already occurred.