The US Cybersecurity and Infrastructure Security Agency (CISA) has formally added three distinct Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The federal determination confirms that malicious actors are actively weaponizing these vulnerabilities in real-world intrusions to achieve local privilege escalation and assume total administrative dominance over compromised servers and container instances.
The cataloged vulnerabilities include CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964. Forensically, it is critical to note that none of these flaws represent unauthenticated remote code execution (RCE) entry vectors; rather, they require pre-existing unprivileged local access or command execution on the host. However, for adversaries who have breached outer perimeters via web shells or credential stuffing, kernel local privilege escalations (LPE) are among the most lethal tools for escaping container sandboxes and obtaining unrestricted root privileges.
The first flaw, CVE-2025-39682, stems from improper memory handling in the Linux kernel's kernel-space TLS (kTLS) offload subsystem. By dispatching malformed socket options, a local user can induce memory corruption, leading to system takeover. The second, CVE-2026-53266, resides in the legacy ebtables packet-filtering component where insufficient boundary checking allows an out-of-bounds write condition. The third vulnerability, CVE-2025-39964, involves a race condition within the kernel cryptographic interface (`AF_ALG`).
Patches addressing all three issues have been published in upstream Linux kernels and distributed across enterprise operating systems such as Red Hat Enterprise Linux, Canonical Ubuntu, Debian, and SUSE. Because Linux underpins global cloud hosting, containerized Kubernetes microservices, and network virtualization fabrics, CISA has mandated federal compliance and strongly urged private operators to patch immediately.
Actionable Guidance for IT and Security Teams
- Update and Reboot Enterprise Linux Hosts: Deploy the latest stable kernel packages released by your Linux distribution vendor (e.g., via `yum update kernel` or `apt dist-upgrade`) and execute planned reboots to activate patched binaries.
- Blacklist Unnecessary Kernel Modules: If in-kernel TLS acceleration or legacy ebtables are not required in your workload profile, blacklist corresponding modules in `/etc/modprobe.d/`.
- Harden Container Security Profiles: Enforce restrictive seccomp, AppArmor, or SELinux policies to prevent unprivileged containerized applications from establishing arbitrary network sockets or calling `AF_ALG`.
- Tune Linux EDR Sensor Detection: Monitor process lineage and set high-severity telemetry alerts for unprivileged daemon processes suddenly escalating to UID 0 (root).
Evidence Status
- Confirmed: CISA officially bound CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to the KEV registry, confirming weaponization.
- Reported: Major Linux distributions and NIST NVD have verified the technical root causes and issued corresponding security advisories.
- Unconfirmed: Specific advanced persistent threat (APT) attributions remain withheld by CISA for operational protection reasons.
In Brief
- CISA added three Linux kernel vulnerabilities to its KEV catalog following verified in-the-wild exploitation.
- The flaws enable local privilege escalation to root via weaknesses in kTLS, ebtables, and AF_ALG.
- Organizations should expedite enterprise kernel updates and system reboots across all Linux workloads.