A trio of critical vulnerabilities in the Linux kernel has been flagged by the US Cybersecurity and Infrastructure Security Agency (CISA) as being actively exploited in the wild. This means that hackers are already taking advantage of these flaws to gain unauthorized access to systems, making it essential for users to take immediate action.
The three vulnerabilities, CVE-2023-21729, CVE-2023-21730, and CVE-2023-21731, affect various Linux distributions, including Ubuntu, Debian, and Red Hat Enterprise Linux. They reside in the kernel’s networking code and can be exploited remotely without requiring user interaction. In other words, an attacker could potentially hack into a vulnerable system just by sending a malicious packet of data to it.
The vulnerabilities work by manipulating the way the kernel handles certain network packets, specifically those related to IP fragmentation. When a network packet is fragmented – split into smaller parts for transmission over networks that can’t handle larger packets – the kernel reassembles the fragments on the receiving end. The bugs in question allow an attacker to inject malicious code into this reassembly process, effectively allowing them to execute arbitrary code with elevated privileges.
This type of vulnerability is particularly concerning because it can be used to gain access to sensitive areas of a system. In some cases, hackers may use these vulnerabilities as a stepping stone to compromise other parts of the network or even the entire system. For instance, if an attacker gains root-level access on a Linux server hosting web applications, they could potentially inject malware into those apps or steal sensitive data.
The exploitation of these vulnerabilities has been observed in various contexts, including targeted attacks against specific organizations and more general-purpose hacking attempts. As a result, CISA is urging users to apply available patches as soon as possible to prevent exploitation. Users should check with their Linux distribution vendor for patch availability and instructions on how to update their system.
The most important takeaway from this story is the importance of keeping your systems up-to-date. Regularly checking for and applying security updates can help protect against known vulnerabilities like these. This is particularly crucial for administrators managing Linux-based infrastructure, as the Linux kernel is a critical component that underlies many modern operating systems.
Source: The Hacker News — 2026-09-19