CISA Warns of Active Exploitation of Old Linux Flaws
A catastrophic vulnerability that lurked silently within the Linux kernel for nearly 14 years is now actively weaponized in real-world cyberattacks, alongside two other critical errors. The United States Cybersecurity and Infrastructure Security Agency (CISA) officially confirmed the active exploitation of these three flaws, adding them to its infamous Known Exploited Vulnerabilities catalog. CISA has mandated that all federal agencies urgently deploy available updates and mitigation strategies no later than September 22. The Linux ecosystem encountered a remarkably similar scenario this past spring when the “Copy Fail” vulnerability, present in the kernel since 2017, swiftly transitioned into active attacks immediately following the publication of a functional exploit.
The Three Exploited Kernel Flaws Explained
The most ancient of this newly exploited trio, designated as CVE-2025-39964, involves a highly complex race condition nestled within the AF_ALG cryptographic interface. When multiple threads simultaneously attempt to write to a single socket, they can irreparably corrupt the kernel’s internal state, leading to massive memory corruption. Security researchers at STAR Labs successfully demonstrated practical exploitation during the Google kernelCTF. They achieved complete privilege escalation and effortlessly escaped containerized environments. Shockingly, this deeply flawed code resided within the Linux kernel for approximately 14 years.
Another critical flaw, CVE-2026-53266, directly impacts the SNAT implementation within ebtables. When the kernel attempts to rewrite the hardware sender address situated within an ARP packet, it may erroneously modify a shared memory page rather than diligently creating a distinct, writable copy. This catastrophic oversight results in memory corruption, inevitable denial of service, and potential privilege escalation. For a deeper technical dive, researchers have published a detailed analysis and exploit code for CVE-2026-53266. This underlying mechanism eerily mirrors the notorious “pedit COW” vulnerability, where attackers similarly manipulated data directly within the memory cache.
The third compromised vulnerability, CVE-2025-39682, resides deep within the reception path of the kernel TLS (kTLS) protocol. The kernel improperly processes zero-length TLS records pulled from the queue. Under specific, highly specific conditions, it can inadvertently merge records of vastly different types within a single recvmsg() system call. Official documentation from Red Hat confirms the severity of this vulnerability, indicating that remote exploitation is entirely possible if the target system actively utilizes kTLS. Alarmingly, public exploitation code already circulates for this specific vulnerability.
Mitigation Strategies and the Threat Landscape
Currently, CISA has not disclosed the identities of the threat actors deploying these exploits, nor have they identified the targeted organizations. The agency merely confirms that active exploitation of all three vulnerabilities is undeniably occurring. CISA also mandated that administrators conduct rigorous forensic triage on all potentially affected systems. This directive requires security teams to transcend simply verifying patch installation; they must actively hunt for elusive traces of a successful, pre-existing breach. At this time, investigators have uncovered no concrete links connecting these exploits to known ransomware operators.
The primary defensive strategy remains straightforward: rapidly install an updated kernel or deploy the officially patched packages provided by your specific Linux distribution maintainer. To temporarily mitigate the immediate risk, Red Hat recommends applying targeted countermeasures for each specific error. These temporary fixes include completely disabling the AF_ALG module, meticulously deleting any vulnerable ebtables SNAT rules, and aggressively blocking the TLS module on systems where those specific functionalities are deemed non-essential.
This terrifying phenomenon of ancient, legacy code suddenly becoming an active threat vector is certainly not isolated to this current trio. Very recently, four other remarkably old Linux errors, ranging from 10 to 21 years in age, received fully functional root privilege escalation exploits. Alarmingly, under specific configurations, one of these venerable vulnerabilities permitted entirely remote exploitation. As modern exploit development techniques continually evolve, we repeatedly witness how seemingly dormant, decades-old code can suddenly compromise the entire foundation of modern computing infrastructure.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
