The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that attackers are actively exploiting the flaws in real-world attacks.
The vulnerabilities affect different components of the Linux kernel and can lead to consequences ranging from denial-of-service and memory disclosure to local privilege escalation and corruption of cryptographic operations. Details about how attackers are currently exploiting the vulnerabilities have not yet been disclosed. (The Hacker News)
Three Linux Kernel Flaws Under AttackThe most severe vulnerability is CVE-2025-39682, rated 9.8 on the CVSS scale. The flaw affects the kernel’s TLS receive path and results from improper handling of exceptional conditions.
A locally authenticated attacker could exploit the vulnerability to expose memory or cause a denial-of-service condition.
The second vulnerability,CVE-2026-53266, carries a CVSS score of 8.8 and involves an out-of-bounds write in the Linux kernel’s ebtables SNAT ARP rewrite functionality.
Successful exploitation could cause unexpected system behavior or crashes and, more significantly, allow a local attacker to escalate privileges on the affected machine. (The Hacker News)
The third flaw,CVE-2025-39964, is a race condition involving concurrent writes to the same AF_ALG socket. AF_ALG provides user-space applications with access to Linux kernel cryptographic functionality.
Exploitation could crash the system or corrupt the results of cryptographic operations, potentially causing both denial-of-service and data-integrity problems.
Red Hat Confirms Active ExploitationCISA has not disclosed who is exploiting the vulnerabilities, which attacks are using them, or whether the three flaws are being combined as part of the same attack chain.
However, Red Hat has also updated its security advisories to acknowledge active exploitation and warns that public exploits are known to exist.
The company recommends treating the vulnerabilities as high priority and applying available security updates as quickly as possible. (The Hacker News)
The presence of public exploit code can significantly increase the risk because attackers no longer need to independently develop exploitation techniques before targeting vulnerable systems.
Local Vulnerabilities Still Represent Serious RiskUnlike vulnerabilities that allow attackers to compromise systems directly over the internet, these Linux flaws generally require some level of local access.
That does not make them harmless.
Attackers frequently combine vulnerabilities into attack chains. An initial vulnerability, stolen credential, compromised application, or misconfiguration might provide limited access to a Linux server. A local privilege-escalation vulnerability can then provide the second step needed to obtain higher privileges.
This is particularly dangerous on Linux infrastructure running cloud workloads, containers, databases, web services, and other critical enterprise applications.
CISA has given U.S. federal civilian agencies until September 21, 2026 to apply the necessary mitigations under its vulnerability remediation requirements. (The Hacker News)
More Linux Privilege-Escalation Bugs SurfaceThe warning arrives as researchers have also disclosed four additional Linux kernel vulnerabilities capable of enabling local privilege escalation:CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), and CVE-2026-74469 (DiagSpill). (The Hacker News)
The disclosures reinforce an important lesson for organizations operating Linux infrastructure: patching priorities should not be based exclusively on whether a vulnerability is remotely exploitable.
Once attackers establish an initial foothold, local kernel vulnerabilities can become powerful tools for moving from restricted access to deeper control of a compromised system.
With CISA now confirming exploitation of the three kernel flaws, organizations should identify affected Linux systems, review vendor advisories, and prioritize the available kernel updates rather than waiting for more information about the attacks.
Original report — The Hacker News