CISA has confirmed active exploitation of three Linux kernel flaws and directed US federal civilian agencies to apply available fixes or mitigations. The agency added CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266 to its Known Exploited Vulnerabilities catalog on September 18, setting a September 21 remediation deadline and requiring forensic triage of affected assets.

The alert covers separate weaknesses in the kernel TLS receive path, the AF_ALG cryptographic socket interface and bridge Netfilter. CISA has not disclosed the attacks, affected organizations or responsible threat actors. Its catalog also lists ransomware use as unknown for all three vulnerabilities, leaving the scale and purpose of the observed exploitation unclear.

CVE-2025-39682 concerns handling of a zero-length record retrieved from the receive list in kernel TLS. According to NIST and the Linux kernel description, the corner case can violate assumptions used for zero-copy decryption and record queuing. Published severity assessments differ, but the potential effects include memory disclosure and denial of service.

CVE-2025-39964 is a race condition caused by concurrent writes to the same AF_ALG socket. CISA says the resulting data can be interleaved unpredictably, creating inconsistencies in socket state. Reporting by BleepingComputer and SecurityWeek says exploitation may crash a system or corrupt the results of cryptographic operations, affecting availability or data integrity.

CVE-2026-53266 is an out-of-bounds write in the ebtables SNAT path used to rewrite ARP sender hardware addresses. Red Hat says a local attacker on a system with specific bridge Netfilter rules may trigger memory corruption, denial of service or privilege escalation. Red Hat lists disabling ARP hardware-address rewriting in ebtables SNAT rules, or removing affected ARP rules on bridge interfaces, as mitigation.

Administrators should use their Linux distributor's advisory to identify affected packages and install the vendor-provided kernel update, since distributions frequently backport fixes without changing to the latest upstream release. CISA directs organizations to evaluate exposure, follow vendor mitigation guidance and discontinue unsupported products when fixes are unavailable. Because public indicators and incident details have not been released, defenders should also review affected systems under the agency's forensic-triage guidance rather than treating patching alone as proof that no compromise occurred.