CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

Severity

High

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities affecting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence that the vulnerabilities are being actively exploited in the wild.

The three vulnerabilities affect different Linux kernel subsystems and can allow local attackers to cause memory disclosure, denial-of-service, system instability, or local privilege escalation.

CVE ID	Summary	CVSS Score
CVE-2025-39682	An improper-check vulnerability in the Linux kernel TLS receive path that could allow a local authenticated attacker to trigger memory disclosure or denial-of-service.	9.8 (Critical)
CVE-2026-53266	An out-of-bounds write vulnerability in the Linux kernel ebtables SNAT/ARP rewrite path that could allow a local attacker to cause unintended system behavior, denial-of-service, or local privilege escalation.	8.8 (High)
CVE-2025-39964	A race condition involving concurrent writes to the same Linux kernel AF_ALG socket, potentially resulting in system crashes or corruption of cryptographic operation results.	7.8 (High)

Affected Products

The vulnerabilities affect Linux kernel-based systems containing the vulnerable kernel code.

Potentially affected environments include:

Linux servers
Enterprise Linux distributions
Cloud Linux workloads
Virtual machines
Container hosts
Systems using affected kernel networking, TLS or cryptographic subsystems

Organizations should determine exposure based on their specific Linux distribution and kernel version, rather than assuming that every Linux installation is vulnerable.

Recommendation

Organizations running Linux systems are strongly advised to perform the following actions:

Prioritize patching all Linux systems affected by these three CVEs.
Update the Linux kernel using the security updates provided by the relevant distribution vendor.
Review vendor advisories for Red Hat, Ubuntu, SUSE, Debian, Amazon Linux and other affected distributions to determine the appropriate fixed kernel version.
Prioritize internet-facing Linux servers and systems hosting privileged services.
Review authentication and system logs for suspicious local account activity or unexpected privilege escalation.
Investigate unexpected processes, kernel crashes, privilege changes, or abnormal activity involving affected systems.
Where immediate patching is not possible, apply vendor-provided mitigations where available and restrict unnecessary local access.
Because CISA has confirmed exploitation, perform post-patch compromise assessment on systems that remained vulnerable during the exposure window.
Ensure Linux kernel updates are followed by the required system reboot where the distribution requires it for the new kernel to become active.

CISA specifically added these vulnerabilities to the KEV catalog based on evidence of active exploitation and encourages organizations to prioritize remediation accordingly.

Source

https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html