The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding the active exploitation of three distinct vulnerabilities within the Linux kernel, one of which is rated critical. These security issues were added to CISA's catalog last week, with severity ratings ranging from medium to critical. Federal agencies have been mandated to apply available security updates and mitigations for these flaws by the end of today.
One of the vulnerabilities, identified as CVE-2025-39964, is a race condition found in the kernel's AF_ALG cryptographic socket interface. This flaw, which has existed in the Linux kernel for 14 years, allows concurrent writes to corrupt per-socket state, potentially leading to system crashes or alterations of cryptographic results. Offensive security company STAR Labs discovered this issue, demonstrating its potential for privilege escalation and container escape within Google's kernelCTF environment.
Another critical vulnerability is CVE-2026-53266, an out-of-bounds write flaw in the Linux kernel's ebtables SNAT implementation. This defect can cause an ARP address rewrite to modify shared file-backed memory without first ensuring the affected packet range is writable. Red Hat has confirmed the existence of a known exploit for this vulnerability. Researcher Kimmo Suominen has published a technical analysis and patch-status tracker on GitHub, outlining a potential privilege-escalation path, though this specific exploitation chain is inferred by analogy with the "Dirty Pipe" vulnerability and has not been publicly demonstrated.
The third vulnerability, CVE-2025-39682, is a logic flaw in the Linux kernel's TLS receive-path. It mishandles zero-length records queued for later processing, which could allow different TLS record types to be processed together when kTLS is in use. Public exploits for this flaw are available, a fact also confirmed by Red Hat in its security bulletin.
CISA has confirmed that all three vulnerabilities are actively being exploited in attacks, though the agency has not provided specific details about the incidents or the nature of the threat actors involved. The agency has marked all three flaws as requiring forensic triage, meaning federal agencies must examine affected assets for any signs of prior exploitation. As of now, none of these vulnerabilities are flagged as being exploited by ransomware groups.
