CISA warns three Linux kernel flaws are being exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning that attackers are exploiting three Linux kernel flaws, one of them rated critical. The three issues were added separately last week and carry severity ratings ranging from medium to critical, and CISA has given all of them its highest priority for federal agencies, ordering them to apply the available security updates and mitigations by the end of today. One of the vulnerabilities, tracked as CVE-2025-39964, had existed in the Linux kernel for 14 years. The Linux kernel is the core of the operating system, the layer that sits between the hardware and everything running on top of it, which is why a flaw in it can put a very large number of servers and devices at risk at the same time.

The three vulnerabilities are different in nature. CVE-2025-39964 is a race condition, meaning a situation where two operations run at the same moment and interfere with each other, inside the kernel's AF_ALG cryptographic socket interface. Concurrent writes can corrupt the state stored for an individual socket, which can crash a system or change the results of cryptographic work. CVE-2026-53266 is an out of bounds write in the kernel's ebtables SNAT implementation, a networking feature that rewrites source addresses. An out of bounds write means the code writes data outside the memory area it was meant to use, and CISA describes the effect as an ARP address rewrite modifying shared file backed memory without first making the affected packet range writable. ARP, the Address Resolution Protocol, is the mechanism that maps an IP address to a physical network address on a local network. The third issue, CVE-2025-39682, is a logic flaw in the kernel's TLS receive path, the code that handles incoming encrypted connections when kernel TLS, or kTLS, is in use. It mishandles zero length records that are queued for later processing, which can result in different TLS record types being handled together.

CISA says the flaws have been exploited in attacks but has not revealed any details about the incidents or the nature of the threat actors behind them. All three have been marked as requiring forensic triage, which means that for every affected asset, federal agencies must look for evidence that exploitation has already happened rather than simply installing a patch. At the time of writing, none of the three flaws was flagged as exploited by ransomware groups. That distinction is worth keeping in mind: a flaw can be used to break into a machine or to raise an intruder's level of permission without any ransomware being deployed on the way out.

The research behind the disclosures comes from several parties. The offensive security company STAR Labs found CVE-2025-39964, and its researchers say they identified the problem without help from an AI system. STAR Labs demonstrated it by achieving privilege escalation, meaning they gained more permission on a machine than they were entitled to, and a container escape in Google's kernelCTF. A container is an isolated compartment on a shared machine, and escaping it means reaching the wider system outside. For CVE-2025-39682, public exploits are available, something Red Hat also confirmed in its security bulletin, and Red Hat confirmed that a known exploit is available for CVE-2026-53266 as well. Separately, researcher Kimmo Suominen has published a technical analysis and a patch status tracker for CVE-2026-53266 on GitHub, outlining a possible route to privilege escalation that involves modifying file backed memory. Suominen cautions that this proposed exploitation chain is inferred by analogy with Dirty Pipe, a well known Linux kernel flaw that allowed attackers to overwrite files that should have been protected, and that it has not been demonstrated with public exploit code.

For organizations outside government, the question is what the warning means in practice. A very large share of the web runs on Linux, and many hosting platforms, including managed WordPress services, are built on Linux servers. A kernel that has not been updated leaves the whole machine exposed no matter how carefully the website software on top of it is maintained. Kernel fixes normally arrive through the operating system vendor, and they usually need a restart of the machine or of the affected service before they take effect, so a server can appear patched while it is still running the vulnerable code. Two of the three flaws already have public exploit code, which lowers the skill an attacker needs. Teams that run their own Linux servers should treat kernel updates as urgent, follow the security bulletins issued by their distribution, and then confirm that the restart actually took place.

Several things remain unknown. CISA has not said which systems were attacked, who carried out the attacks, or how many organizations were affected, and the exploitation of CVE-2025-39964 has not been described publicly in the same way as the other two. The attack path suggested for CVE-2026-53266 is still only a theory without working public code. What is clear is the sequence CISA has asked for: update, restart, and check the machine for signs that someone got in first. For site owners who would rather not track kernel updates themselves, AEU Hosting offers managed WordPress hosting with security handled end to end as part of the service, and its pages set out what that covers.