CISA Warns of Actively Exploited Critical Linux Kernel Vulnerabilities

Key Takeaways

• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding three critical Linux kernel vulnerabilities.
• These flaws, identified as CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, are currently being exploited in active attacks.
• Federal civilian agencies are mandated to remediate these issues by September 21, 2026, and conduct forensic investigations due to confirmed in-the-wild exploitation.
• Patches are available for all three vulnerabilities, and immediate application is crucial.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding three Linux kernel vulnerabilities that are actively being exploited by threat actors. This warning necessitates immediate patching and thorough forensic investigation across affected systems.

On September 18, 2026, CISA incorporated CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 into its Known Exploited Vulnerabilities (KEV) catalog. Under Binding Operational Directive (BOD) 26-04, federal civilian agencies are required to remediate these vulnerabilities by September 21, 2026.

The KEV catalog serves as a definitive list of security flaws that have been confirmed to be exploited in real-world attacks. BOD 26-04 further mandates that federal civilian agencies prioritize and expedite remediation efforts based on the operational risks these exploited vulnerabilities pose.

Notably, CISA has stipulated that all three vulnerabilities require forensic triage. This means that affected agencies must not merely apply patches but also conduct comprehensive investigations into potentially compromised assets to uncover any evidence of a breach or exploitation.

Linux Kernel Vulnerabilities Under Active Exploitation

CVE-2025-39682: Critical TLS Vulnerability

The most severe of the three, CVE-2025-39682, is a critical improper-condition check residing in the Linux kernel’s Transport Layer Security (TLS) receive path. This flaw boasts a CVSS score of 9.8. It details a specific scenario where a zero-length record, retrieved from the rx_list, circumvents the intended handling of record types by recvmsg(). This bypass can lead to subsequent TLS records being processed under incorrect zero-copy and queuing assumptions.

This vulnerability becomes particularly relevant when kernel TLS (kTLS) is active and linked to TCP sockets. Red Hat has confirmed that this vulnerable code path can be triggered remotely when kTLS functionality is in use. Consequently, internet-accessible services employing kTLS represent a high-priority target for immediate remediation.

At a fundamental code level, this vulnerability violates a crucial rule for the receive path: a single recvmsg() operation should either process contiguous data records or a solitary non-data record. When the initial queued record possesses zero length, the system may skip the type-transition check, potentially resulting in an insecure socket-buffer state.

While upstream stable-kernel patches are available, administrators are strongly advised to utilize distribution-provided kernel packages that incorporate the fix, rather than relying solely on generic version numbers to assess their exposure.

CVE-2026-53266: High-Severity Out-of-Bounds Write

CVE-2026-53266 presents a high-severity out-of-bounds write vulnerability within the netfilter bridge ebtables SNAT target, earning a CVSS score of 8.8. During an optional Address Resolution Protocol (ARP) sender hardware-address rewrite, the kernel may invoke skb_store_bits() without first verifying the writability of the destination range. If this data persists in a nonlinear socket-buffer fragment backed by a splice-imported file page, the operation can directly write into the underlying page.

Red Hat has cautioned that a local attacker, targeting a system configured with specific bridge netfilter rules, could exploit this flaw to induce memory corruption, trigger a denial-of-service condition, or potentially achieve privilege escalation. The upstream patch for this issue ensures that the ARP sender hardware-address range is confirmed as writable before the kernel proceeds to read the ARP header and execute the modification.

CVE-2025-39964: AF_ALG Race Condition

CVE-2025-39964 describes a race condition found in the kernel’s AF_ALG cryptographic interface. When multiple concurrent writes are directed to the same AF_ALG socket, their operations can become unpredictably interleaved, leading to an inconsistent internal state within the socket.

This vulnerability has a CVSS score of 7.8, with its attack vector indicating that a local attacker with low privileges could exploit it. The potential impact on confidentiality, integrity, and availability is rated as high. The corrective measure implemented involves introducing exclusive write ownership, ensuring that only one writer can utilize sendmsg() at any given time.

CISA has not released specific details regarding the identities of the attackers, the victims, or the precise exploitation techniques employed in these incidents. Furthermore, the potential involvement of ransomware remains unconfirmed. Despite the absence of granular campaign information, the inclusion of these vulnerabilities in the KEV catalog unequivocally confirms their active exploitation in the wild, underscoring the urgency of remediation.

What You Should Do

• Immediately install vendor-provided kernel updates for all affected Linux systems.
• After applying patches, reboot the systems into the corrected kernel and verify that the active kernel version reflects the update.
• If patches are not yet available, implement vendor-recommended mitigations, follow any cloud-specific guidance related to BOD 26-04, or discontinue the use of unsupported products.
• Consider temporary protective measures such as disabling unused kTLS functionality, removing ARP-rewriting ebtables SNAT rules, restricting CAP_NET_ADMIN capabilities, or preventing the af_alg module from loading, but only after a careful assessment of the operational impact.
• Before remediation, preserve all relevant telemetry data and thoroughly inspect exposed systems for any signs of compromise, including kernel crashes, suspicious privilege changes, unexpected namespace activity, or unauthorized netfilter modifications.
• Given the September 21 deadline, prioritize rapid patching alongside comprehensive forensic assessments to determine if vulnerable Linux systems were compromised prior to patch deployment.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.