CISA Orders Emergency Action As Three Linux Kernel Flaws Come Under Active Attack

The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to urgently investigate and secure systems affected by three Linux kernel vulnerabilities after receiving evidence that attackers are exploiting the flaws in real-world operations.

The vulnerabilities—CVE-2025-39964, CVE-2025-39682 and CVE-2026-53266—affect separate parts of the Linux kernel, including its user-space cryptographic interface, kernel TLS implementation and ebtables network-address translation code.

CISA added all three security defects to its Known Exploited Vulnerabilities catalogue, which is reserved for vulnerabilities the agency says have credible evidence of exploitation. Two of the flaws, CVE-2025-39964 and CVE-2026-53266, were announced together in a September 18 alert.

US federal civilian executive branch agencies were instructed to apply vendor-provided patches or other approved mitigations by September 21. The unusually compressed deadline reflects CISA’s assessment that the vulnerabilities require the highest level of operational attention.

The directive also calls for forensic triage of affected assets. Agencies must therefore do more than install updates: they need to determine whether vulnerable systems may already have been compromised.

CISA has not disclosed which attackers are using the vulnerabilities, how many systems have been targeted or whether the three flaws have been combined in a single intrusion chain. None was identified by the agency as being associated with ransomware as of September 21.

The absence of public incident details should not be interpreted as evidence that exploitation is limited. Inclusion in the KEV catalogue confirms observed exploitation, but it does not indicate how widespread the activity is or reveal whether attackers are using private exploits, modified public research or tools developed independently from published proof-of-concept code.

Fourteen-year cryptographic flaw threatens hosts and containers

CVE-2025-39964 affects AF_ALG, a Linux interface that allows user-space applications to access cryptographic operations through sockets.

The vulnerability arises when multiple threads write simultaneously to the same AF_ALG socket. Those concurrent writes can become interleaved, leaving the socket’s internal state inconsistent and potentially causing memory corruption.

Red Hat describes the problem as a race condition in the kernel’s cryptographic user API. According to its analysis, a local user may be able to crash a vulnerable system or corrupt the results of cryptographic operations, producing denial-of-service and data-integrity consequences. The upstream fix introduces exclusive write ownership so that only one writer can issue a sendmsg() operation against the socket at a time.

The vulnerability has attracted particular attention because the affected code dates to Linux 2.6.38, released in 2011. STAR Labs said the defect had consequently remained in the kernel for roughly 14 years before it was identified.

The Linux kernel’s own vulnerability data indicates that affected branches extend back to version 2.6.38. Fixed releases listed by the project include 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9 and 6.17, although organisations should rely on the packages and advisories supplied by their Linux distributor rather than comparing upstream version numbers alone. Enterprise vendors frequently backport security patches without changing the package to the corresponding upstream version.

Public information assigns conflicting severity scores to CVE-2025-39964. NVD has scored it at 5.5, Red Hat at 7.3 and the CVE record at 7.8. This variation illustrates the limits of relying on a headline CVSS number when evaluating a kernel vulnerability. Red Hat assesses it as requiring local access and low privileges, but the effect of a successful exploit could include high confidentiality and availability impact.

Local access does not necessarily make the flaw low risk. An attacker may first compromise a public-facing application, steal a user account or gain code execution inside a container, then use a kernel vulnerability to break out of the restricted environment or elevate privileges on the underlying host.

The Linux CVE record says an unprivileged user—including one operating inside a container or unprivileged user namespace—can reach the vulnerable AF_ALG functionality without a capability check. Its technical assessment describes the resulting corruption as potentially suitable for privilege escalation.

STAR Labs researchers demonstrated privilege escalation and a container escape in Google’s kernelCTF environment. That result is important because it shows that the defect’s impact can extend beyond a crash or corrupted cryptographic output under suitable conditions.

However, a kernelCTF exploit is not, by itself, evidence that the identical technique is being used in current attacks. It establishes exploitability in a controlled target and increases the urgency of patching, while CISA’s separate KEV designation supplies the confirmation of exploitation in the wild.

ebtables flaw creates page-cache corruption risk

CVE-2026-53266 is an out-of-bounds write affecting the ebtables Source Network Address Translation target in Linux’s bridge netfilter subsystem.

The vulnerable code can rewrite both the Ethernet source address and, optionally, the sender hardware address inside an Address Resolution Protocol packet. The problem occurs because the ARP rewrite can be performed with skb_store_bits() without first ensuring that the corresponding region of the socket buffer is writable.

If the affected area references shared, file-backed memory, the operation may modify page-cache content rather than an ordinary private packet buffer. That creates the possibility of memory corruption, system failure or local privilege escalation.

Red Hat analysis rates the flaw as important and says a local attacker could use it to trigger memory corruption, denial of service or elevation of privileges.

The security update changes the ebtables code so the ARP portion of the packet is made writable before the address is replaced. Red Hat has already incorporated the correction into kernel security updates, including an advisory published in August.

Security researcher Kimmo Suominen has published a patch-status tracker and analysis exploring whether the bug could be turned into a page-cache modification primitive resembling Dirty Pipe, the major Linux vulnerability disclosed in 2022.

That comparison is technically significant. Dirty Pipe allowed unprivileged users to overwrite data in read-only files through the page cache, which could then be used to alter privileged binaries or configuration files. In the case of CVE-2026-53266, the proposed escalation path depends on arranging affected packet memory so the ARP rewrite reaches a useful file-backed page.

The full Dirty Pipe-style chain remains an analytical possibility rather than a universally demonstrated public exploit for this specific vulnerability. Administrators should distinguish between a confirmed underlying memory-corruption flaw, CISA-confirmed exploitation and the still-developing public understanding of precisely how attackers are weaponising it.

Systems using Linux bridge networking, ebtables, container networking or virtualisation should receive particular scrutiny. These technologies are common in hosting environments, security appliances, container platforms and infrastructure that connects virtual workloads through software bridges.

Exposure cannot be determined merely by checking whether a machine has a public IP address. Because CVE-2026-53266 is principally a post-compromise escalation issue, a vulnerable internal server or container host may become valuable after an attacker obtains an initial foothold through an entirely different weakness.

Kernel TLS flaw can be triggered remotely

The third vulnerability, CVE-2025-39682, is found in the Linux kernel TLS receive path, commonly known as kTLS.

Kernel TLS moves portions of TLS record processing into the kernel to improve performance. It is used in some high-throughput web, storage and network services, but it is not active on every Linux server simply because the system supports ordinary HTTPS or TLS connections.

The vulnerability concerns the way kTLS processes a zero-length record retrieved from its receive list. A carefully constructed sequence containing different TLS record types can cause the implementation to violate the rule that each recvmsg() call should process either contiguous application-data records or a single non-data record.

Red Hat says the bug may be triggered remotely, but only when the kernel was built with TLS support and the TLS upper-layer protocol has been attached to the relevant TCP socket. This significantly narrows exposure compared with an ordinary flaw affecting every TLS-enabled service.

Researchers at STAR Labs published a more detailed analysis showing that the fault can lead to a use-after-free condition. In the demonstrated sequence, application data is followed by a zero-length handshake record and another application-data record. Mishandling of the change in record type can cause the kernel to place an invalid socket buffer back on the receive list. When the socket is later closed, the kernel accesses memory that has already been freed.

The research reproduced a kernel crash on Linux 6.12.41 with Kernel Address Sanitizer enabled. Separate public kernelCTF material reports a working exploit for the vulnerability in a mitigation-enabled test environment, with the researcher reporting 79 successful runs out of 100 attempts.

Assessments of CVE-2025-39682’s severity differ considerably. NVD and the CVE record assign a critical 9.8 score, while Red Hat rates it at 7.0 because it assesses the attack as requiring high complexity and expects lower confidentiality and integrity impact in its products.

Where immediate patching is impossible, Red Hat says administrators can mitigate the flaw by preventing the kernel TLS module from loading. That measure should be evaluated carefully because disabling kTLS may affect applications that depend on it or cause services to fall back to user-space TLS processing.

Why the three vulnerabilities matter together

The flaws do not affect one shared kernel component and should not be treated as a single technical exploit. Their importance lies in the range of environments and attack stages they cover.

CVE-2025-39682 potentially provides a remote entry point where kTLS is in use. CVE-2025-39964 may allow a low-privileged local user or compromised container to attack kernel memory. CVE-2026-53266 creates a separate escalation opportunity in systems using affected bridge netfilter and ebtables functionality.

CISA has not said that attackers are chaining them. Nevertheless, their addition to the KEV catalogue at approximately the same time should prompt organisations to review Linux risk as a complete attack path rather than as three isolated patch tickets.

Cloud and container environments warrant special attention. A vulnerability that requires local access may still be exposed to untrusted code running inside a container, a CI/CD worker, a multi-user development platform or a compromised application process. If exploitation reaches the host kernel, controls applied inside the container may no longer provide an effective security boundary.

The flaws also illustrate why asset inventories based only on distribution names are insufficient. Two servers running the same Linux distribution may have very different exposure depending on their installed kernel packages, loaded modules, network configuration, workload type and whether features such as AF_ALG, ebtables or kTLS are reachable.

Organisations urged to patch and investigate

Administrators should obtain fixed kernel packages directly from their Linux distribution or appliance vendor and ensure that systems are rebooted into the corrected kernel. Installing an update without restarting may leave the vulnerable kernel running in memory unless an approved live-patching mechanism has applied the relevant correction.

Security teams should prioritise internet-facing Linux servers, container and Kubernetes nodes, virtualisation hosts, multi-user systems, CI/CD runners and appliances that rely on bridge networking. Systems processing untrusted workloads should be treated as higher risk even if the underlying flaw is classified as local.

Forensic review should focus on the period before patching and should not rely solely on conventional malware signatures. Kernel exploitation may be used to gain root privileges, escape a container, disable monitoring or alter evidence before a visible payload is deployed.

Investigators should review unexplained kernel crashes and panics, anomalous container-to-host activity, unexpected privilege changes, unusual access to AF_ALG sockets, changes to kernel modules and ebtables configuration, suspicious activity from previously low-privileged service accounts, and gaps or tampering in audit and endpoint telemetry.

Because CISA has not published indicators of compromise or described the observed attacks, defenders currently lack a definitive signature for the exploitation campaigns. That makes rapid patching, exposure reduction and behavioural investigation more important than waiting for a vendor-neutral detection rule.

The agency’s warning ultimately changes the status of these flaws from theoretical or laboratory risks to operational threats. Organisations outside the US federal government are not legally bound by CISA’s remediation deadline, but the KEV catalogue is widely used as a global patching priority list. Any enterprise running Linux infrastructure should now treat the three vulnerabilities as urgent—while recognising that installing the fixes is only one part of the required response.