A trio of critical vulnerabilities in the Linux kernel has been identified by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as being actively exploited by hackers. The agency has marked all three flaws with the highest priority, warning federal agencies to apply available security updates and mitigations by the end of today.
The three security issues are CVE-2025-39964, a 14-year-old flaw that exists in the kernel’s AF_ALG cryptographic socket interface; CVE-2026-53266, an out-of-bounds write vulnerability in the ebtables SNAT implementation; and CVE-2025-39682, a TLS receive-path logic flaw. The first of these issues allows concurrent writes to corrupt per-socket state and potentially crash systems or alter cryptographic results. The second can cause an ARP address rewrite to modify shared file-backed memory without making the affected packet range writable. The third mishandles zero-length records queued for later processing, potentially allowing different TLS record types to be processed together when kTLS is in use.
According to CISA, all three vulnerabilities have been exploited in attacks, although no details have been released about the incidents or the nature of the threat actors. Researchers at STAR Labs discovered CVE-2025-39964 and demonstrated its potential impact by achieving privilege escalation and container escape in Google’s kernelCTF. Public exploits are available for both CVE-2025-39682 and CVE-2026-53266, as confirmed by Red Hat in its security bulletin. A researcher has also published a technical analysis and patch-status tracker for CVE-2026-53266 on GitHub.
The fact that these vulnerabilities have been exploited in the wild means that affected systems may already be compromised. CISA is advising federal agencies to conduct forensic triage, examining each asset for signs of exploitation. This process involves reviewing logs and system activity to determine if an attack has occurred, rather than simply applying patches.
One key takeaway from this story is the importance of keeping Linux kernel vulnerabilities patched. Given the severity of these issues and their potential impact on system security, administrators should prioritize updating affected systems as soon as possible.
Source: Bleeping Computer — 2026-09-21