The US Cybersecurity and Infrastructure Security Agency has warned that hackers are actively exploiting three vulnerabilities affecting the Linux kernel, including one flaw rated critical. Federal agencies have been directed to prioritise fixes and examine affected systems for signs of exploitation.
Which Linux Flaws Are Being Exploited?
The three security issues were added separately and carry severity ratings ranging from medium to critical. One of them, tracked as CVE-2025-39964, affects the Linux kernel and has a critical severity rating.
CISA placed all three vulnerabilities at the highest priority for federal agencies, requiring them to apply available security updates and mitigations by the end of the day.
Proposal for Conducting Cyber Crisis Drill, Tabletop Exercise (TTEx) & CCMP Readiness Exercise
What Is CVE-2025-39964?
CVE-2025-39964 is a race condition in the Linux kernel’s AF_ALG cryptographic socket interface. The flaw can allow concurrent writes to corrupt per-socket state and potentially crash systems or alter cryptographic results.
Offensive security company STAR Labs found the vulnerability and said its researchers discovered it without assistance from an AI system. They demonstrated the flaw’s vulnerability by achieving privilege escalation and container escape in Google’s kernelCTF.
How Do the Other Two Flaws Work?
The second vulnerability, CVE-2026-53266, is an out-of-bounds write vulnerability in the Linux kernel’s nftables SNAT implementation. It can cause an ARP address rewrite to modify shared file-backed memory without first making the affected packet range writable.
The third, CVE-2025-39682, is a Linux kernel TLS receive-path logic flaw. It mishandles zero-length records queued for later processing, potentially allowing different TLS record types to be processed together when kTLS is in use.
Are Exploits Already Available?
CISA said the vulnerabilities have been exploited in attacks but did not disclose details about the incidents or the threat actors involved.
For CVE-2025-39682, three public exploits are available, a fact also confirmed by Red Hat in its security bulletin. Red Hat has also confirmed a known exploit for CVE-2026-53266.
Security researcher Kimmo Suominen has published a technical analysis and patch-status tracker for CVE-2026-53266 on GitHub, outlining a potential privilege-escalation path involving modifications to file-backed memory.
What Is Known About CVE-2025-39682?
Researchers noted that the proposed exploitation chain for CVE-2025-39682 is inferred by analogy with Dirty Pipe and has not been demonstrated with public exploit code.
This distinction is important because the presence of technical analysis does not necessarily mean that every proposed exploitation method has been publicly demonstrated.
What Must Federal Agencies Do?
CISA has marked all three vulnerabilities as requiring forensic triage. For every affected asset, federal agencies need to examine systems for signs that exploitation has already occurred.
The agency’s warning goes beyond simply installing updates, requiring attention to whether vulnerable systems may already have been compromised.
At the time of the report, none of the three vulnerabilities had been flagged as being exploited by ransomware groups.
The420 View
Active exploitation changes the priority of a vulnerability from a theoretical software weakness to an immediate security concern. The availability of public exploits for some of these Linux flaws adds to that risk.
Organisations running affected Linux systems should treat available security updates and forensic checks as urgent, particularly where vulnerable systems handle sensitive workloads or provide privileged access.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
