CISA Flags Active Exploitation of Linux Kernel Vulnerabilities

• •CISA has flagged three Linux kernel vulnerabilities for active exploitation.
• •CVE-2025-39964 allows local attackers to exploit a race condition in AF_ALG sockets.
• •Federal agencies must apply patches by September 21, 2026, according to CISA.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including CVE-2025-39964, which allows local attackers to exploit a race condition in AF_ALG sockets. This vulnerability, along with CVE-2025-39682 and CVE-2026-53266, has been confirmed to be actively exploited in the wild. The vulnerabilities can lead to system crashes, denial-of-service (DoS), and privilege escalation. Red Hat has issued advisories urging immediate action to address these vulnerabilities. Federal agencies are advised to apply necessary fixes by September 21, 2026. The vulnerabilities primarily affect multi-tenant Linux servers, container hosts, and systems running untrusted local code. The risk is heightened in environments where operational technology is involved. The situation is evolving as researchers continue to monitor the exploitation methods.