US agency flags three actively exploited Linux kernel vulnerabilities, including a 14-year-old bug
CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch them by the end of the day. The flaws include a critical race condition in the AF_ALG interface, an out-of-bounds write in ebtables SNAT, and a TLS receive-path logic error. Public exploits exist for two of the issues, and one vulnerability remained undetected for 14 years.
The three flaws were added to CISA's catalog separately last week, with patch deadlines set for today. CVE-2025-39964, discovered by STAR Labs researchers without AI assistance, enables privilege escalation and container escape in Google's kernelCTF environment. Red Hat confirmed public exploits exist for two of the three issues. Researcher Kimmo Suominen published a technical analysis for CVE-2026-53266, though his proposed exploitation chain is inferred by analogy with Dirty Pipe and lacks demonstrated public exploit code. CISA has designated all three flaws for forensic triage, requiring agencies to inspect affected assets for prior compromise. None are currently linked to ransomware groups.
These kernel-level flaws could affect millions of Linux systems worldwide, including cloud infrastructure, servers, and embedded devices. The 14-year undetected bug highlights how legacy code can harbor latent risks. Organizations beyond federal agencies may face pressure to prioritize patching, though downtime concerns could delay action. The container-escape potential in one flaw may particularly concern cloud providers and multi-tenant environments, where a single compromise could expose numerous customers' data.