The Alert
CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation and marking all three as highest priority for federal agencies — with security updates and mitigations required by the end of the same day the alert went out. All three are also flagged as requiring forensic triage, meaning affected assets need to be examined for signs of exploitation that may already have occurred, not just patched going forward.
The Three Flaws
| CVE | Component | Issue |
|---|---|---|
| CVE-2025-39964 | AF_ALG cryptographic socket interface | Race condition in concurrent writes, corrupting per-socket state — a bug that existed in the kernel for 14 years before this disclosure |
| CVE-2026-53266 | ebtables SNAT implementation | Out-of-bounds write that can modify shared file-backed memory without first making the packet range writable |
| CVE-2025-39682 | TLS receive path | Mishandles zero-length TLS records, potentially letting different record types be processed together when kTLS is in use |
CVE-2025-39964 carries a critical severity rating; CISA's KEV entries for the other two do not specify a formal severity tier, but their inclusion alongside a critical race-condition bug — with public exploits already circulating for CVE-2025-39682 and CVE-2026-53266 — underscores that severity labels aside, all three are being treated as urgent.
Impact & Remediation
- Affected: Federal agencies and any Linux systems running vulnerable kernel versions across the three affected subsystems
- Active exploitation: Confirmed by CISA; no specific threat actor attribution has been disclosed
- Public exploit code: Available for CVE-2025-39682 and CVE-2026-53266
- Ransomware use: Not currently observed, per CISA's KEV notes
CISA's guidance is direct: apply available security updates and mitigations immediately, and conduct forensic triage on any system that was exposed to the vulnerable kernel paths before patching — the KEV forensic-triage flag specifically exists to catch cases where exploitation already occurred prior to remediation.
Remediation Checklist
- Patch immediately — apply the kernel updates addressing CVE-2025-39964, CVE-2026-53266, and CVE-2025-39682 for your distribution.
- Forensically triage systems that had the AF_ALG interface, ebtables SNAT, or kTLS in active use prior to patching.
- Federal agencies should treat the same-day deadline as binding per Binding Operational Directive requirements tied to KEV additions.
- Monitor for exploitation attempts on unpatched systems in the interim — public PoCs exist for two of the three flaws, lowering the bar for opportunistic attackers.