Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) has added three actively exploited Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch them immediately. These flaws could lead to denial-of-service attacks and memory disclosure, and CISA has not yet disclosed details on exploitation attempts.
The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with three Linux kernel flaws, urging federal agencies to immediately patch them. These vulnerabilities represent a significant risk to systems running vulnerable Linux kernels.
Tracked as CVE-2025-39682 (CVSS score of 9.8), the first of the bugs is a critical-severity issue impacting the kernel’s handling of zero-length records on the rx_list in the TLS receive path. This occurs when the `recvmsg()` logic – each `recvmsg()` call processes either DATA or non-DATA records – breaks out of the processing loop when an initial zero-length record is pulled from `rx_list`. A local attacker could exploit this improper check for unusual or exceptional conditions to cause a denial-of-service (DoS) condition or trigger memory disclosure.
The second vulnerability, CVE-2025-39964 (CVSS score of 7.8), is described as a race condition: issuing two writes to the same AF_ALG socket leads to data being interleaved in an unpredictable fashion. An attacker could trigger the security defect to create inconsistencies in the socket’s internal state, leading to system crashes or corrupted cryptographic operation results, which could cause DoS conditions.
The third Linux kernel flaw newly added to CISA’s KEV list is CVE-2026-53266 (CVSS score of 8.8), an out-of-bounds write issue in the bridge Netfilter ebtables Source Network Address Translation (SNAT) target. Under certain conditions, an Address Resolution Protocol (ARP) sender hardware address is written directly into a nonlinear socket-buffer fragment, causing memory corruption. An attacker can trigger the unsafe write with a crafted packet containing an ARP payload, leading to unauthorized memory modification outside the intended packet buffer.
CISA has not shared details on the exploitation of the three vulnerabilities, but told federal agencies they should patch all three within three days. Several security vendors, including Check Point, Kaspersky, and Tanium, have also released patches for their respective products.