The US Cybersecurity and Infrastructure Security Agency added three Linux kernel flaws to its catalogue of exploited vulnerabilities on 18 September [1].
It gave federal agencies until 21 September to deal with them [1].
The most severe, CVE-2025-39682, is in the kernel's handling of TLS, the encryption behind secure connections. A zero-length record can bypass the intended handling, so later records are processed in the wrong way. NIST scores it 9.8 out of 10 [1][2].
What it covers
The second flaw, CVE-2025-39964, is a race condition in the kernel's crypto socket interface, where concurrent writes corrupt the socket's internal state [1].
The third, CVE-2026-53266, is an out-of-bounds write in the ebtables network-bridge code, scored 8.8 [1][3].
CISA notes the flaws affect an open-source component that may be used in many products, and that some affected products may be end-of-life, without fixes [1].
Two of the flaws were published in 2025. Being listed now means CISA has seen them exploited, not that they are new [1][2].
What it does not tell you
Which systems were attacked, by whom, or for what. CISA's entries do not say [1].
Comments