Linux Kernel Vulnerabilities Exploited in the Wild

TL;DR

CISA confirmed active attacks targeting three distinct Linux kernel flaws. The vulnerabilities involve race conditions in cryptographic sockets, memory corruption in network packet filters, and a flaw in the kernel’s TLS record handling. System operators should apply vendor updates or disable vulnerable modules immediately.

Why This Matters

Industry estimates indicate that Linux powers billions of cloud instances, enterprise servers, and connected devices worldwide. Therefore, flaws within core kernel subsystems create serious security risks for critical infrastructure. Because threat actors are exploiting these weaknesses in the wild, unpatched systems face immediate danger. Attackers can destabilize production environments or escalate local user accounts into full administrative control.

How the Attacks Work

The first flaw, CVE-2025-39964, stems from a race condition inside the kernel cryptographic user API. The advisory notes: “The AF_ALG datapath allowed two writers on the same socket, causing request payloads to interleave unpredictably.” As a result, this flaw can corrupt cryptographic results or cause denial-of-service conditions.

The second vulnerability, CVE-2026-53266, affects the netfilter bridge ebtables module. The advisory warns: “An Important flaw in the Linux kernel’s ebtables SNAT target allows a local attacker to achieve privilege escalation.” When rewriting address ranges in nonlinear network fragments, the driver copies data into memory pages without confirming write access.

The third flaw, CVE-2025-39682, sits in the kernel’s TLS receive path. It stems from the mishandling of zero-length records on the rx_list queue. According to the kernel fix, each recvmsg() call must process either contiguous data records or a single non-data record. A corner case appears when the first queued record is zero length, which the code failed to handle correctly. CISA lists it as an improper check for unusual or exceptional conditions.

Affected Versions

These Linux kernel vulnerabilities impact numerous production Linux distributions running unpatched kernel trees. Specifically, the issues affect systems with active cryptographic user APIs or customized bridge packet filters.

Patch and Mitigation Steps

Administrators must deploy the latest distribution updates immediately to secure their endpoints. In their advisories, officials urged organizations to review both the two-CVE catalog update and the same-day single-CVE addition for the TLS flaw. If immediate updates are impractical, teams should apply temporary mitigations. For the cryptographic flaw, administrators can blacklist the af_alg kernel module. Meanwhile, operators can mitigate the netfilter issue by disabling ARP hardware address rewriting in ebtables rules.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.