The U.S. Cybersecurity and Infrastructure Security Agency has warned that hackers are actively exploiting three Linux kernel vulnerabilities, one of which sat undiscovered in the operating system’s code for 14 years.
CISA added the three flaws to its Known Exploited Vulnerabilities catalog last week, ranking them from medium to critical severity. The agency has given federal civilian agencies until the end of today to apply available patches and mitigations, and has ordered a forensic check of every affected system for signs that an intrusion already took place.
What the three flaws do
The most serious of the group, tracked as CVE-2025-39964, is a race condition in the kernel’s AF_ALG cryptographic socket interface. Concurrent writes can corrupt a socket’s internal state, which attackers can use to crash a system or tamper with cryptographic results, as BleepingComputer first reported.
The second flaw, CVE-2026-53266, lives in the kernel’s ebtables SNAT feature, the code that rewrites network addresses at a low level. An out-of-bounds write there lets an ARP address rewrite alter shared, file-backed memory before the system has confirmed that memory range is safe to modify.
The third, CVE-2025-39682, affects how the kernel processes incoming TLS traffic. It mishandles zero-length encrypted records queued for later processing, which can cause the system to mix up different types of TLS records when kernel-level TLS is in use.
A bug that predates most current Linux distributions
What stands out about CVE-2025-39964 is its age. Security researchers at STAR Labs say the flaw had existed in the Linux kernel for 14 years before anyone found it, and they found it without any help from an AI system, a detail worth noting given how often automated tools are now credited with catching bugs of this kind. The team demonstrated the vulnerability by achieving privilege escalation and a container escape inside Google’s kernelCTF testing environment.
Public exploit code already exists for the other two vulnerabilities. Red Hat has confirmed known exploits for both CVE-2025-39682 and CVE-2026-53266 in its own security bulletins, and researcher Kimmo Suominen has published a technical writeup and patch-status tracker for CVE-2026-53266 on GitHub. Suominen notes that the privilege-escalation path he outlines is inferred by analogy with the notorious Dirty Pipe bug from 2022, rather than demonstrated with working exploit code of his own.
Why this reaches beyond government systems
CISA’s binding directive technically applies only to federal civilian agencies, but the Known Exploited Vulnerabilities catalog functions as a de facto industry benchmark. Cloud providers, hosting companies and enterprise IT teams routinely track it as a baseline for what needs urgent attention, since the Linux kernel underpins the vast majority of cloud servers, Android devices and embedded systems worldwide.
CISA has not disclosed details about the attacks it observed or the actors behind them, and none of the three flaws is currently linked to ransomware activity. That silence is typical of early-stage advisories, but it also means system administrators are being asked to patch quickly on the strength of a warning rather than a full incident report.
The episode adds to a pattern security researchers have flagged through 2026: core, low-level components of widely used software, the kind few people think about until something breaks, remain a favored target precisely because a single flaw can sit unnoticed for years while quietly touching an enormous number of systems.
