CISA Flags Three Linux Kernel Vulnerabilities Already Exploited

The U.S. Cybersecurity and Infrastructure Security Agency has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming that there is evidence of active exploitation. CVE-2025-39682, with a CVSS score of 9.8, concerns the handling of anomalous conditions in the TLS receive path and may expose sensitive memory or cause a denial-of-service. CVE-2026-53266 is an out-of-bounds write in the ebtables path for ARP SNAT rewriting, potentially exploitable by a local attacker to cause memory corruption, crashes, or privilege escalation. CVE-2025-39964, meanwhile, is a race condition in AF_ALG sockets that may compromise the integrity of concurrent cryptographic operations. Inclusion in the KEV catalog makes it a priority to check installed kernel versions, apply available updates, and restrict unnecessary local access, especially on exposed or multi-user systems.

Source: Security Affairs