Security Brief: CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities
https://vulnify.app/blog/security-brief-cisa-three-linux-kernel-vulnerabilities-exploited

CISA has added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its Known Exploited Vulnerabilities catalog after confirming exploitation in the wild. The Linux kernel flaws affect kernel TLS, ebtables bridge networking, and the AF_ALG cryptographic interface, creating risks ranging from memory corruption and denial of service to privilege escalation.

What happened The U.S. Cybersecurity and Infrastructure Security Agency has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog after determining that there is evidence of active exploitation. The additions are CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964. The vulnerabilities affect very different Linux kernel subsystems. CVE-2025-39682 occurs in the kernel TLS receive path, CVE-2026-53266 affects bridge netfilter and the ebtables SNAT implementation, and CVE-2025-39964 affects the kernel's AF_ALG cryptographic socket interface. The Linux kernel CNA currently assigns CVSS 3.1 scores of 9.8 to CVE-2025-39682, 8.8 to CVE-2026-53266, and 7.8 to CVE-2025-39964. Vendor scoring can differ because distributions package, configure, and backport the Linux kernel differently. CISA's KEV inclusion is operationally important because it is based on evidence of exploitation rather than theoretical exploitability alone. The Hacker News reported that details about the observed attacks have not yet been made public, including who is exploiting the vulnerabilities, which organizations are being targeted, and whether the three flaws are being combined into a single attack chain. Federal Civilian Executive Branch agencies covered by CISA's Binding Operational Directive 26-04 were given a September 21, 2026 remediation deadline. That deadline does not apply automatically to private organizations, but KEV inclusion provides a strong reason for Linux administrators to prioritize checking affected systems. The three vulnerabilities at a glance CVE-2025-39682 Kernel TLS receive path CVSS 9.8 CVE-2026-53266 ebtables SNAT / ARP rewrite CVSS 8.8 CVE-2025-39964 AF_ALG crypto socket race CVSS 7.8 These vulnerabilities should not be treated as interchangeable. They have different prerequisites, affected kernel branches, and exploitation paths. A normal internet-facing Linux web server may have a very different exposure profile from a container host using bridge networking or a multi-user server where untrusted local processes can access AF_ALG sockets. CVE-2025-39682: kernel TLS receive-path flaw CVE-2025-39682 affects the Linux kernel's software implementation of kernel TLS, commonly referred to as kTLS. The bug involves handling zero-length TLS records placed on the receive list. The Linux kernel's TLS receive code expects each recvmsg() operation to process either a sequence of contiguous data records or a single non-data record. Under a particular sequence involving a zero-length record, the vulnerable implementation can incorrectly carry state between records and violate assumptions used during zero-copy decryption and queue management. The Linux kernel CNA assigns CVE-2025-39682 a CVSS 3.1 score of 9.8 with a network attack vector and no privileges required. Other vendor assessments and reporting characterize practical exploitation differently depending on the affected kernel build and deployment. Administrators should therefore use their Linux distribution’s advisory to determine actual exposure rather than assuming every HTTPS server is remotely exploitable. This does not mean every HTTPS website running Linux is automatically remotely exploitable. The affected kernel TLS receive path needs to be in use. Applications and services may use userspace TLS without enabling Linux kTLS. Administrators should therefore determine whether affected workloads actually use kernel TLS rather than inferring vulnerability only from the presence of HTTPS. The upstream Linux security announcement identifies the following stable kernel releases as containing fixes for their respective branches: 6.1.149 6.6.103 6.12.44 6.16.4 6.17-rc3 Distribution kernels often backport fixes without adopting these exact upstream version numbers. Debian, Ubuntu, Red Hat Enterprise Linux, SUSE, Amazon Linux, Oracle Linux, and cloud-provider kernels should be assessed using the distribution's own security advisory and package version. CVE-2026-53266: ebtables SNAT memory corruption CVE-2026-53266 affects the Linux bridge netfilter implementation, specifically the ebtables SNAT target when it rewrites the sender hardware address inside an ARP packet. The vulnerable code can write into an area of packet memory without first ensuring that the target range is safely writable. Under the required conditions, that memory may be backed by a shared or splice-imported file page. The kernel can therefore modify underlying memory that should not have been altered through the packet rewrite operation. Red Hat describes the consequences as memory corruption, denial of service, unintended system behavior, or potentially local privilege escalation. Exploitation requires a system with the relevant bridge netfilter configuration, which significantly narrows the affected attack surface compared with a universally reachable network vulnerability. The Linux kernel CNA gives the vulnerability a CVSS score of 8.8 and notes that exploitation requires local privileges sufficient to configure the relevant networking path. Namespace-local privileges can matter here, so administrators of container hosts and platforms using Linux bridging should pay particular attention. The published evidence does not by itself establish that the vulnerability provides a general-purpose container escape, and it should not be described as one without specific supporting evidence. Upstream fixed releases include: 5.10.259 5.15.210 6.1.176 6.6.143 6.12.94 6.18.36 7.0.13 7.1 For systems that cannot immediately be patched, Red Hat recommends disabling ARP hardware-address rewriting in ebtables SNAT rules or removing ebtables SNAT rules operating on ARP traffic over bridge interfaces where doing so is operationally acceptable. CVE-2025-39964: AF_ALG concurrent-write race condition CVE-2025-39964 affects AF_ALG, the Linux kernel interface that allows userspace applications to access kernel cryptographic algorithms through sockets. The vulnerable implementation allowed two concurrent writes to the same AF_ALG socket. Those writes could become interleaved and leave the socket's internal state inconsistent. The upstream fix introduces exclusive ownership while a write is taking place so that concurrent writers cannot manipulate the same state simultaneously. The Linux kernel CNA rates CVE-2025-39964 at CVSS 7.8. The attack vector is local and requires low privileges, but no user interaction. The upstream assessment states that ordinary unprivileged users can access relevant AF_ALG functionality where the feature is available, including potentially from unprivileged namespaces. The security consequence goes beyond incorrect cryptographic output. The CNA's technical assessment describes the possibility of kernel memory disclosure, attacker-influenced kernel writes, privilege escalation, and system crashes resulting from corrupted internal state. Fixed upstream kernel releases include: 5.10.245 5.15.194 6.1.154 6.6.108 6.12.49 6.16.9 6.17 As with the other two vulnerabilities, administrators using distribution kernels should confirm the presence of the backported fix through their Linux vendor rather than comparing only the output of uname -r with upstream version numbers. Why CISA KEV status matters CVSS describes characteristics that influence technical severity. KEV answers a different and often more urgent question: is there reliable evidence that attackers are actually exploiting the vulnerability? All three vulnerabilities now meet CISA's threshold for inclusion in the Known Exploited Vulnerabilities catalog. That makes them materially different from vulnerabilities that are technically severe but have no evidence of real-world exploitation. At the time of reporting, public information does not explain how the three vulnerabilities are being used operationally. It is therefore premature to claim that a particular threat actor is using them, that exploitation is associated with ransomware, or that all three are being chained together. That uncertainty should not be interpreted as evidence that exploitation is insignificant. It simply means defenders should distinguish confirmed facts from assumptions while prioritizing remediation based on KEV status. Why it matters for website owners These are Linux kernel vulnerabilities rather than flaws in WordPress, PHP, Nginx, Apache, Node.js, or another web application framework. A website's application code may therefore be fully patched while the underlying server remains exposed through its operating-system kernel. Linux underpins a large share of internet infrastructure, including virtual private servers, cloud instances, container hosts, Kubernetes worker nodes, dedicated web servers, reverse proxies, load balancers, databases, and application servers. CVE-2025-39964 and CVE-2026-53266 are primarily local attack paths. That does not make them irrelevant to web infrastructure. Attackers frequently combine vulnerabilities. An initial weakness in a website, stolen credential, malicious package, compromised container, or exposed service may provide low-privileged code execution. A kernel privilege-escalation vulnerability can then become the second stage that converts that foothold into greater control of the host. CVE-2025-39682 requires separate attention because the upstream kernel CNA considers it network reachable when the affected kTLS receive path is exposed. Administrators should determine whether their applications or infrastructure use kernel TLS rather than assuming that standard HTTPS configuration alone establishes exposure. What to check on your site Identify the running kernel. Use operating-system inventory or commands such as uname -r to identify the kernel currently booted on each Linux host. Check the distribution's advisory. Do not rely solely on upstream kernel version numbers because enterprise distributions regularly backport security fixes. Confirm that the patched kernel is actually running. Installing a kernel package does not protect the server until the machine has booted into the corrected kernel. Review kTLS usage. Determine whether services use Linux kernel TLS and whether the affected receive path may be reachable. Review bridge netfilter configuration. Hosts using Linux bridges, container networking, ebtables, or ARP SNAT rules deserve closer inspection for CVE-2026-53266. Review multi-user and container workloads. Systems allowing untrusted local processes or tenants can have greater exposure to local kernel attack paths. Check AF_ALG availability. Determine whether applications or untrusted local processes can use the kernel cryptographic socket interface affected by CVE-2025-39964. Patch internet-facing and shared hosts first. Prioritize systems where compromise would expose multiple websites, applications, customers, or containers. Review unsupported Linux versions. If a distribution or kernel branch is no longer receiving security updates, migration to a supported platform may be necessary. Look for evidence of prior compromise. KEV status means patching should be accompanied by reasonable incident triage on high-value or previously exposed systems. Patching Linux kernels correctly Kernel remediation differs from updating a normal web application package. The corrected kernel generally needs to be installed and then loaded by rebooting the server. A machine can therefore show a patched kernel package in its package manager while continuing to operate on the vulnerable kernel currently held in memory. Administrators should verify both the installed package and the running kernel after maintenance. On cloud platforms, it is also important to understand whether kernels are managed by the guest operating system, the cloud vendor, a managed Kubernetes platform, or another infrastructure provider. Live kernel patching technologies may apply some security fixes without a conventional reboot, but support varies by vendor and vulnerability. Organizations using live patching should confirm explicitly that the relevant CVE has been covered rather than assuming every kernel vulnerability is automatically patched. Where infrastructure is managed by a hosting provider, website owners may not have direct kernel access. In that case, confirmation should come from the provider that the underlying hosts have received the relevant security updates. TLS scanning does not prove the kernel is patched Because one of the three vulnerabilities affects kernel TLS, it is important to distinguish TLS configuration testing from kernel vulnerability assessment. Vulnify's Checker can help review publicly visible certificate and TLS information, while Deep Analysis can provide a deeper external view of a website's TLS configuration. These tools can identify public TLS configuration issues, but they cannot establish whether CVE-2025-39682 has been patched in the Linux kernel. The vulnerability exists below the normal application and certificate layers. Kernel version and distribution security status must therefore be checked directly on the host or through the infrastructure provider. For background on externally visible TLS controls, the Configuration Basics guide explains protocol versions, certificates, cipher configuration, and related web-facing considerations. Recommended response Organizations operating Linux infrastructure should treat all three KEV additions as patch-priority items. Start by identifying affected kernel packages through vendor advisories, install the available security updates, and ensure systems are running the corrected kernel. For CVE-2026-53266, administrators who cannot patch immediately should review whether the affected ebtables SNAT ARP functionality is required and consider Red Hat's configuration-based mitigation. For CVE-2025-39964, reducing untrusted local execution can limit exposure while patching is pending, but this is not equivalent to remediation. Shared servers, developer environments, container platforms, and multi-tenant systems deserve particular attention. For CVE-2025-39682, determine whether kTLS is enabled and used by internet-facing services. Systems where kernel TLS processes network traffic should be prioritized according to the vendor's affected-package guidance. Finally, consider whether affected hosts may already have been compromised. CISA has confirmed real-world exploitation but has not published enough attack detail to provide a definitive log signature or universal indicator of compromise. Existing endpoint, authentication, process, audit, container, and network telemetry may therefore be more useful than searching for one specific artifact. Related reading Configuration Basics Article 32 for Web Teams: Technical Measures Explained Conclusion CISA's addition of CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to the KEV catalog changes the priority of these Linux kernel vulnerabilities because exploitation is no longer hypothetical. The flaws affect different subsystems and should be assessed individually. CVE-2025-39682 involves the kernel TLS receive path, CVE-2026-53266 concerns ebtables SNAT processing of ARP traffic on Linux bridges, and CVE-2025-39964 involves concurrent writes through the AF_ALG cryptographic socket interface. For website operators, the main lesson is that application security does not stop at the web application. A fully updated CMS, framework, or reverse proxy can still run on a vulnerable operating-system kernel. Linux hosts supporting websites, containers, databases, and related infrastructure should be checked against distribution advisories, patched promptly, and rebooted or otherwise confirmed to be running the corrected kernel. Because CISA has confirmed exploitation without yet publishing detailed attack information, high-value systems should also receive appropriate compromise triage rather than treating patch installation alone as proof that no earlier exploitation occurred. Sources Hacker News: CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild Known Exploited Vulnerabilities Catalog