1. Basic Information
- Original Title: CISA alerts of active exploitation of three Linux kernel flaws
- Published Date: 2026-09-21
- Collected Date: 2026-09-22T08:00:36+09:00
- Original Source: BleepingComputer
- Severity: Critical
- Basis for Severity: CISA lists all three vulnerabilities as known to be exploited. The issues include remotely triggerable kTLS processing, local privilege-escalation potential, and a demonstrated kernelCTF container escape, although the exploitation paths and outcomes observed in real attacks remain undisclosed.
- Related Sources:
- Red Hat CVE-2025-39964
- Red Hat CVE-2025-39682
- Red Hat CVE-2026-53266
- Kimmo CVE-2026-53266 technical analysis
- CVE: CVE-2025-39964, CVE-2026-53266, CVE-2025-39682
- Target Products and Services: Linux kernel, AF_ALG, ebtables SNAT, kTLS
- Threat Actor: Unidentified
2. Executive Summary
CISA has added three Linux kernel vulnerabilities to the KEV catalog. Because details of the observed exploitation have not been disclosed, defenders should assess the three vulnerabilities separately: the kernelCTF privilege-escalation and container-escape demonstration for AF_ALG, the inferred privilege-escalation path in ebtables SNAT, and the remotely triggerable kTLS flaw.
3. Attack Flow
The following are the attack paths for each of the three vulnerabilities. Although CISA has confirmed active exploitation, specific attack paths or post-compromise behaviors used in real attacks have not been made public.
Path A: CVE-2025-39964 (AF_ALG)
- A low-privileged local user or a process inside a container writes to the same AF_ALG socket concurrently.
- The race condition causes inconsistent socket internal states, leading to system crashes or corrupted cryptographic results.
- STAR Labs demonstrated privilege escalation and container escape in a kernelCTF environment. This is a result from a test environment and should be distinguished from post-compromise behavior in real attacks.
Path B: CVE-2026-53266 (ebtables SNAT)
- In environments configured with specific bridge netfilter and ebtables SNAT rules, a low-privileged attacker uses the rewriting path for ARP source hardware addresses.
- A shared page that is not set to be writable is modified, leading to memory corruption, DoS, and potential local privilege escalation.
- Public analysis infers a privilege escalation path based on similarities to Dirty Pipe, but stable privilege escalation using public exploits has not been demonstrated.
Path C: CVE-2025-39682 (kTLS)
- Specially crafted TLS records are sent to a network service using kTLS.
- Due to the processing of zero-length records in the receive queue, different record types are processed by the same recvmsg().
- Red Hat states that remote triggering is possible, but the specific impact caused in real attacks has not been published.
4. Attacker Position and Execution Location
- CVE-2025-39964 requires low-privileged local execution, and CVE-2026-53266 requires low-privileged access in an environment with specific rules.
- CVE-2025-39682 can originate from a remote attacker who can reach a network service using kTLS.
5. What Victims and Administrators See
Victims
- No general end-user action is available beyond allowing administrators to complete kernel updates and required reboots on managed devices.
Administrators
- Apply the vendor patch and reboot with the updated kernel. As a temporary mitigation until the update is applied, Red Hat advises preventing the tls module from loading and removing ebtables SNAT rules that rewrite ARP hardware addresses. Note that Red Hat does not provide an easy mitigation for AF_ALG.
6. Success and Failure Conditions
Success Conditions
- The vulnerable kernel is running and the vendor’s patch or backported fix has not been applied.
- The subsystem and configuration corresponding to each CVE are enabled, and the attacker can reach the required local or network surface.
Failure Conditions
- Apply the vendor patch and reboot with the updated kernel.
- Until the fix is applied, follow the product vendor's guidance to prevent the tls module from loading and remove ebtables SNAT rules that rewrite ARP hardware addresses. For AF_ALG, evaluate the impact of configuration changes and prioritize vendor patches.
7. What Happens Upon Success
- Depending on the CVE, system crashes, corruption of cryptographic processing results, memory corruption, privilege escalation, container escape, or denial of service may occur.
- For CVE-2025-39964, privilege escalation and container escape have been demonstrated in a test environment. CVE-2026-53266 also has the potential for local privilege escalation, but stable exploitation with public exploits remains unproven. The specific impact of CVE-2025-39682 in real attacks is unknown.
8. Observable Logs
- Email: No evidence that phishing was used for initial access has been published.
- Proxy / SWG / DNS: Check for abnormal TLS records, resets, retransmissions, and sources before and after kTLS service crashes.
- Endpoint / EDR: Check for kernel oops and KASAN/BUG events, unusual AF_ALG socket activity, ebtables rule changes, namespace operations, and newly spawned UID 0 processes.
- Identity / IdP: Check for root logins after privilege escalation, token usage, and service account anomalies.
- SaaS / Cloud: Check for abnormal access to container control planes, cloud metadata, and secret stores.
- Network: Check for lateral movement between hosts, connections to unknown IPs, and multiple service scans from the same source.
9. Determining Attack Success
Confirmed in Public Information
- Active Exploitation Reported (Outcomes Undisclosed): CISA lists all three vulnerabilities in the KEV catalog, indicating evidence of exploitation in the wild. However, the affected organizations, exploitation paths, achieved impact, post-compromise behavior, and threat actors have not been disclosed.
- Privilege escalation confirmed in test environment: STAR Labs demonstrated privilege escalation and container escape for CVE-2025-39964 on kernelCTF. This does not mean the same result has been confirmed in real attacks.
Determination Criteria for Your Organization
- Initial execution confirmed: Correlate input to the vulnerable subsystem with a kernel fault at the exact same timestamp, and check for uid 0 processes, movement into host namespaces, and execution of unknown binaries immediately after the exploit.
- Subsequent compromise confirmed: Corroborate credential access, lateral movement, and operations against other containers or cloud resources with independent evidence.
10. Investigation Playbook
- Trigger: Use kernel oops, unexpected reboots, container escape indicators, and kTLS service anomalies as triggers.
- Initial Checks: Check kernel packages/running versions, vendor backports, usage of AF_ALG, ebtables, and kTLS, and exposure.
- Endpoint: Preserve journals, dmesg, audits, eBPF/EDR, and container runtime events.
- Identity and Cloud: Check root/service accounts, SSH keys, cloud credentials, and secret access.
- Follow-on Activity: Track persistence, lateral movement, and access to other workloads.
- Containment: Isolate the host, update to a patched kernel, reboot, and rotate exposed credentials.
- Classification: Separate probes, kernel triggers, privilege escalation, container escape, and subsequent compromises.
11. Detection Ideas
- Single Event: Detect AF_ALG sockets, ebtables modifications, and kTLS connection anomalies at the exact same time as kernel errors.
- Timeline Correlation: Correlate low-privilege/container processes with kernel faults, uid 0 processes, and namespace changes.
- Hunting: Cross-reference the vulnerable kernel inventory with hosts using AF_ALG, ebtables, and kTLS, and search for recent crashes and root processes.
- Log Gaps: Without kernel telemetry, memory corruption successes may be missed, so consolidate journals, audits, container runtimes, and networks.
- Priority Controls: Patch and reboot hosts targeted by KEV, and prioritize the isolation of public kTLS services and multi-tenant hosts.
12. Facts / Inference / Hypothesis
Facts
- CISA added the three vulnerabilities to the Known Exploited Vulnerabilities catalog without disclosing exploit details, attackers, or ransomware usage.
- CVE-2025-39964 causes memory corruption via a race condition in the AF_ALG crypto socket, and privilege escalation/container escape has been demonstrated in kernelCTF.
- CVE-2026-53266 is an out-of-bounds write in ebtables SNAT processing, leading to local privilege escalation or DoS in specific bridge netfilter/ARP rewrite configurations.
- CVE-2025-39682 involves zero-length record processing in the kTLS receive logic, allowing remote triggers in services using kTLS.
Inference
- Publicly exposed services using kTLS and multi-tenant container hosts that rely on the kernel for privilege separation require different prioritization because the three vulnerabilities have distinct exposure and exploitation conditions despite sharing the same KEV status.
Hypothesis
No additional hypotheses. Unconfirmed items are listed under "Unknowns and Additional Investigation".
13. MITRE ATT&CK
- T1068 Exploitation for Privilege Escalation (Confidence: medium): Privilege escalation has been demonstrated in test environments for CVE-2025-39964, and CVE-2026-53266 has a potential privilege escalation path. It is not public whether real attacks reached this stage.
- T1190 Exploit Public-Facing Application (Confidence: medium): CVE-2025-39682 can be triggered via the network on public services using kTLS.
14. Unknowns and Additional Investigation
- Active exploitation chains, targets, IoCs, and success rates for each CVE.
- Impacts reached and target protocols/services in active exploitation of CVE-2025-39682.
- Conditions under which public exploits for CVE-2026-53266 reliably achieve actual privilege escalation.
15. Impact on SOCs and Organizations
Linux servers, container hosts, and network appliances require confirmation of kernel versions and vendor backports. Rather than simple version comparisons, overlay the usage status of AF_ALG, bridge netfilter/ebtables SNAT, and kTLS onto the asset inventory, and patch internet-facing kTLS and multi-tenant hosts with the highest priority.
16. Summary by Role
- SOC: Correlate kernel crashes, OOB writes, AF_ALG/ebtables/kTLS anomalies with immediately following root processes, namespace escapes, and credential access.
- Administrators: Apply vendor patches and follow vendor guidance to prevent the tls module from loading and remove ebtables SNAT rules that rewrite ARP hardware addresses until patches are applied.
- Users: No general end-user action is available beyond allowing administrators to complete kernel updates and required reboots on managed devices.
Top comments (0)