GoKawiilCISA flags active exploitation of three Linux kernel vulnerabilities
CISA has added three Linux kernel security flaws to its Known Exploited Vulnerabilities catalog, warning that attackers are actively exploiting them in the wild. The bugs include CVE-2025-39964, a 14-year-old race condition in the AF_ALG crypto socket interface; CVE-2026-53266, an out-of-bounds write in ebtables SNAT; and CVE-2025-39682, a flaw in the kernel's TLS receive path. Federal agencies were ordered to patch these by end of day, though CISA has not disclosed details on the attackers or specific incidents.
GoKawiil's interpretation of the reporting above, not reported fact.
These flaws span core kernel subsystems—cryptography, networking, and TLS handling—making them attractive for privilege escalation and container escape on Linux servers that underpin cloud infrastructure and enterprise systems. With public exploits already circulating for two of the three bugs and one vulnerability lurking undetected for 14 years, organizations running unpatched kernels face immediate risk even without knowing who is behind the attacks.
- CISA mandated federal agencies patch three actively exploited Linux kernel flaws by day's end.
- CVE-2025-39964 is a 14-year-old race condition demonstrated to enable container escape.
- Public exploits already exist for two of the three vulnerabilities, per Red Hat's confirmation.
YubiKey 5C NFC Security Key — With Linux kernel exploits actively being used in the wild, hardening system and account access matters more than ever. A hardware security key like the YubiKey adds a strong layer of authentication for SSH and admin logins on Linux servers, reducing the risk of unauthorized access even if other vulnerabilities are exploited. It's a practical, widely supported tool for sysadmins tightening security in response to alerts like this one.”,
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-21
Published there as: “CISA alerts of active exploitation of three Linux kernel flaws”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.