The US Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about three exploited vulnerabilities in the Linux kernel, affecting federal agencies and potentially many others. The agency has added these critical flaws to its Known Exploited Vulnerabilities (KEV) catalog, urging all affected organizations to patch them within the next three days.
The first vulnerability, tracked as CVE-2025-39682 with a CVSS score of 9.8, is a critical-severity issue that affects how the Linux kernel handles zero-length records in the TLS receive path. This “corner case” occurs when an initial zero-length record is pulled from the rx_list, breaking out of the processing loop. A local attacker can exploit this improper check to cause a denial-of-service (DoS) condition or trigger memory disclosure.
In simpler terms, the kernel’s handling of encrypted data can be tricked into decrypting it incorrectly, leading to potentially catastrophic consequences. This vulnerability is particularly concerning because it requires only local access and can be exploited by an attacker with minimal privileges.
The second flaw, CVE-2025-39964 with a CVSS score of 7.8, is a race condition that occurs when two writes are made to the same AF_ALG socket in quick succession. This causes data to become interleaved in an unpredictable manner, potentially leading to system crashes or corrupted cryptographic operation results.
The third vulnerability, CVE-2026-53266 with a CVSS score of 8.8, is an out-of-bounds write issue affecting the bridge Netfilter ebtables Source Network Address Translation (SNAT) target. Under certain conditions, this can cause memory corruption by writing an ARP sender hardware address directly into a nonlinear socket-buffer fragment.
CISA has not revealed any details on how these vulnerabilities are being exploited in the wild, but it’s clear that they pose significant risks to affected organizations. The agency is taking these threats seriously and urging all federal agencies to patch the flaws within three days. This level of urgency highlights the severity of these vulnerabilities and emphasizes the importance of timely patching.
In practical terms, this means that any organization using Linux should review their systems for these vulnerabilities and apply patches as soon as possible. This is especially crucial for those in critical infrastructure sectors or with sensitive data to protect. Additionally, users can take steps to harden their systems by implementing robust security measures, such as network segmentation and access controls.
The inclusion of these three vulnerabilities in CISA’s KEV catalog serves as a stark reminder that even seemingly secure systems can harbor hidden threats. It’s essential for all organizations to stay vigilant and proactive in addressing known vulnerabilities, lest they fall victim to an exploit.
Source: SecurityWeek — 2026-09-21