Summary
CISA added three Linux kernel vulnerabilities (CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964) to its Known Exploited Vulnerabilities catalog, requiring immediate patching and review. These flaws allow for remote exploitation of kTLS and local privilege escalation through netfilter and cryptographic interfaces.
Take Action:
Update your Linux systems to the fixed kernel version from your vendor (check their advisory, not uname -r) and reboot. Prioritise anything internet-facing or where untrusted or external code runs, such as Kubernetes nodes, CI runners, shared hosting and jump boxes. Because these flaws are already being exploited, also check those systems for signs of a break-in like unexpected privilege changes or unusual user namespace activity. If you can't patch, confirm the affected modules (kTLS, ebtables SNAT, AF_ALG) are unused and block them as a temporary measure.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (0)