AI-generated editorial illustration; not a documentary photograph.
CISA is warning that attackers are exploiting three Linux kernel vulnerabilities, including one rated critical. The agency added all three to its highest-priority list for federal agencies and ordered them to apply available updates or mitigations by the end of Sept. 21, 2026.
Three separate kernel flaws
The vulnerabilities were added to CISA's list separately during the previous week. CVE-2025-39964 affects the kernel's AF_ALG cryptographic socket interface and can corrupt per-socket state through concurrent writes. The flaw was present in the kernel for 14 years, according to the report.
CVE-2026-53266 is an out-of-bounds write in the ebtables SNAT implementation. CVE-2025-39682 affects the Linux kernel TLS receive path, where mishandled zero-length records can cause different TLS record types to be processed together when kTLS is enabled.
Exploitation evidence varies
CISA says the three vulnerabilities have been used in attacks but has not disclosed the incidents or identified the threat actors. Public exploits are available for CVE-2025-39682, according to Red Hat, which also confirmed a known exploit for CVE-2026-53266.
STAR Labs reported finding CVE-2025-39964 independently of AI assistance and demonstrated privilege escalation and container escape in Google's kernelCTF. That demonstration describes the vulnerability's potential impact, while CISA's warning concerns exploitation in attacks.
Forensic checks required
CISA has marked all three flaws for forensic triage, requiring federal agencies to examine every affected asset for evidence of prior exploitation. Researcher Kimmo Suominen has described a possible privilege-escalation path for CVE-2026-53266, but the proposed chain is inferred from Dirty Pipe and has not been demonstrated with public exploit code.
None of the vulnerabilities is currently identified as exploited by ransomware groups. The source does not provide details about affected Linux distributions, the broader victim population or the availability of fixes outside the federal directive.
Source: CISA alerts of active exploitation of three Linux kernel flaws
SIGNAL TITANS
Leave a Reply