Linux Kernel Vulnerabilities Exploited in the Wild

TL;DR

CISA confirmed active attacks targeting two distinct Linux kernel flaws. The vulnerabilities involve race conditions in cryptographic sockets and memory corruption in network packet filters. System operators should apply vendor updates or disable vulnerable modules immediately.

Why This Matters

Linux powers billions of cloud instances, enterprise servers, and connected devices worldwide. Therefore, flaws within core kernel subsystems create serious security risks for critical infrastructure. Because threat actors are exploiting these weaknesses in the wild, unpatched systems face immediate danger. Attackers can destabilize production environments or escalate local user accounts into full administrative control.

How the Attacks Work

The first flaw, CVE-2025-39964, stems from a race condition inside the kernel cryptographic user API. The advisory notes: “The AF_ALG datapath allowed two writers on the same socket, causing request payloads to interleave unpredictably.” As a result, this flaw can corrupt cryptographic results or cause denial-of-service conditions.

The second vulnerability, CVE-2026-53266, affects the netfilter bridge ebtables module. The advisory warns: “An Important flaw in the Linux kernel’s ebtables SNAT target allows a local attacker to achieve privilege escalation.” When rewriting address ranges in nonlinear network fragments, the driver copies data into memory pages without confirming write access.

Affected Versions

These Linux kernel vulnerabilities impact numerous production Linux distributions running unpatched kernel trees. Specifically, the issues affect systems with active cryptographic user APIs or customized bridge packet filters.

Patch and Mitigation Steps

Administrators must deploy the latest distribution updates immediately to secure their endpoints. If immediate updates are impractical, teams should apply temporary mitigations. For the cryptographic flaw, administrators can blacklist the af_alg kernel module. Meanwhile, operators can mitigate the netfilter issue by disabling ARP hardware address rewriting in ebtables rules.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.