The **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** is sounding the alarm over three **Linux kernel** vulnerabilities currently being exploited in the wild. These security flaws, varying in severity from medium to critical, were added to **CISA's** Known Exploited Vulnerabilities Catalog last week.  Federal agencies have been given a strict deadline to implement available security updates and mitigations, highlighting the immediate threat posed by these issues. All three vulnerabilities have been marked with the highest priority for remediation. ### The Vulnerabilities Under Attack The three actively exploited vulnerabilities are: * **CVE-2025-39964**: A race condition affecting the kernel’s AF_ALG cryptographic socket interface. This flaw allows concurrent writes to corrupt per-socket state, potentially leading to system crashes or altered cryptographic results. This particular vulnerability has reportedly existed in the **Linux kernel** for 14 years. * **CVE-2026-53266**: An out-of-bounds write vulnerability found in the **Linux kernel**’s ebtables SNAT implementation. This can cause an ARP address rewrite to modify shared file-backed memory without proper write permissions. * **CVE-2025-39682**: A logic flaw in the **Linux kernel** TLS receive-path. It mishandles zero-length records queued for later processing, which could allow different TLS record types to be processed together when kTLS is in use. **CISA** has confirmed active exploitation but has not disclosed specifics about the incidents or the identities of the threat actors involved. ### Discovery and Public Exploits The discovery of **CVE-2025-39964** is credited to offensive security company **STAR Labs**. Their researchers successfully demonstrated privilege escalation and container escape in **Google**’s kernelCTF environment, notably without the aid of AI systems. Both **CVE-2025-39682** and **CVE-2026-53266** have public exploits available, as confirmed by **Red Hat** in their respective security bulletins. Researcher **Kimmo Suominen** has published a technical analysis and patch-status tracker for **CVE-2026-53266** on **GitHub**, detailing a potential privilege-escalation path. However, **Suominen** notes that this exploitation chain is inferred by analogy with **Dirty Pipe** and has not been publicly demonstrated with exploit code. ### Forensic Triage Mandated In response to the active exploitation, **CISA** has mandated “forensic triage” for all three flaws. This requires federal agencies to meticulously examine every affected asset for any indicators of compromise or signs of prior exploitation. At present, none of the vulnerabilities are linked to ransomware campaigns.