CISA Alerts: 3 Critical Linux Kernel Vulnerabilities Actively Exploited

Post Views: 12

CISA has issued an urgent alert regarding the ongoing exploitation of three critical vulnerabilities within the Linux kernel, including one classified as high severity.

CISA Urgent Alert

Government entities have been instructed to prioritize remediation efforts and conduct thorough assessments of affected systems for evidence of compromise. The three security flaws, each assigned varying severity ratings, were disclosed individually and are now under active exploitation. All three flaws have been designated as immediate priorities by CISA, with federal agencies mandated to deploy available patches and mitigations by the conclusion of the current day.

Vulnerability Details

CVE-2025-39964

This vulnerability involves a race condition in the AF_ALG cryptographic socket interface of the Linux kernel. It enables concurrent write operations to corrupt per-socket state, potentially leading to system crashes or altered cryptographic outputs. The vulnerability was identified by offensive security firm STAR Labs, which confirmed the discovery was conducted independently without AI assistance. Researchers demonstrated its exploitability by achieving privilege escalation and container escape within Google’s kernelCTF environment.

CVE-2026-53266

This is an out-of-bounds write flaw in the nftables SNAT implementation of the Linux kernel. It allows for ARP address rewriting to manipulate shared file-backed memory without prior write permissions for the affected packet range. Security researcher Kimmo Suominen has provided a technical analysis and patch status tracker for CVE-2026-53266 on GitHub, outlining a potential privilege-escalation pathway involving modifications to file-backed memory. Red Hat also verified the existence of a known exploit for this vulnerability.

CVE-2025-39682

This pertains to a logic error in the Linux kernel’s TLS receive-path handling. It improperly manages zero-length records queued for later processing, potentially enabling mixed TLS record types to be processed simultaneously when kTLS is active. For this vulnerability, three public exploit frameworks have been identified, as noted in Red Hat’s security advisory. Researchers have inferred an exploitation chain based on similarities to the Dirty Pipe vulnerability, though no public exploit code has been demonstrated.

CISA’s Directive and Response

CISA confirmed that these vulnerabilities are being actively exploited in real-world attacks, though specific details about the incidents or the actors involved remain undisclosed. Federal agencies are required to perform forensic triage on all affected systems, conducting detailed examinations to detect signs of prior compromise. CISA’s directive extends beyond patch deployment, emphasizing the need to assess whether vulnerable systems may have already been breached.

Security Implications

As of the report’s publication, none of the three vulnerabilities had been linked to ransomware groups. Active exploitation transforms a theoretical software weakness into an immediate security threat. The availability of public exploits for certain Linux vulnerabilities heightens this risk. Organizations operating affected Linux systems must treat security updates and forensic evaluations as urgent priorities, particularly for systems handling sensitive workloads or providing elevated access.