Federal agencies face an urgent mandate after the U.S. Cybersecurity and Infrastructure Security Agency (CISA) disclosed that attackers are actively exploiting three Linux kernel flaws. The vulnerabilities carry severity ratings spanning medium to critical, with one designated as the most severe. CISA has assigned the highest priority designation to all three issues and ordered federal agencies to deploy patches and mitigations by end of business today.

The three vulnerabilities were disclosed separately over the past week. CVE-2025-39964, a race condition affecting the kernel's AF_ALG cryptographic socket interface, had gone unpatched for 14 years before discovery. The flaw permits concurrent writes that can corrupt per-socket state, potentially leading to system crashes or manipulation of cryptographic operations.

  • CVE-2026-53266: an out-of-bounds write in the Linux kernel's ebtables SNAT implementation allowing ARP address rewrites to modify shared file-backed memory without first making the affected packet range writable
  • CVE-2025-39682: a TLS receive-path logic defect in the Linux kernel that mishandles zero-length records queued for deferred processing, potentially causing different TLS record types to be processed together when kTLS is active

CISA confirmed that these vulnerabilities are being weaponized in real-world attacks but declined to disclose specifics about the incidents or attacker profiles.

Offensive security firm STAR Labs uncovered CVE-2025-39964 through its own research efforts. The team demonstrated the vulnerability by achieving privilege escalation and container escape within Google's kernelCTF environment, stating that their researchers found the issue with no help from an AI system.

Public exploit code already exists for CVE-2025-39682, a finding corroborated by Red Hat's security advisory. Red Hat also confirmed the availability of a known exploit for CVE-2026-53266.

Researcher Kimmo Suominen has made available a technical analysis and patch-status tracker for CVE-2026-53266 on GitHub, detailing a potential privilege-escalation route that involves tampering with file-backed memory. Suominen notes, however, that the proposed exploitation chain is inferred by analogy with Dirty Pipe and has not been demonstrated with public exploit code.

CISA has designated all three flaws as requiring "forensic triage," obligating federal agencies to inspect each affected system for evidence of prior exploitation attempts.

As of now, none of the three vulnerabilities has been observed in use by ransomware operators.