CISA Alerts Organizations to Active Exploitation of Three Linux Kernel Flaws

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent advisory on Tuesday, warning that threat actors are actively weaponizing three newly disclosed vulnerabilities in the Linux kernel. The agency’s alert urges all operators of Linux‑based systems to apply patches immediately and to begin investigations into potential compromise.

The three flaws—identified as CVE‑2025‑39682, CVE‑2026‑53266 and CVE‑2025‑39964—affect core kernel components that handle memory management and process scheduling. According to CISA, the vulnerabilities can be chained to achieve privilege escalation, allowing an attacker who gains limited access to a system to obtain root‑level control.

CISA’s notice marks the first time the agency has added these specific CVEs to its Known Exploited Vulnerabilities (KEV) catalog, a list that highlights flaws observed in the wild. The agency’s advisory notes that exploit code for the three bugs has been seen in the wild, though it does not disclose details about the groups or campaigns involved. By flagging the vulnerabilities as “actively exploited,” CISA signals that the risk level is high and that remediation cannot be delayed.

Linux powers a broad swath of critical infrastructure, from web servers and cloud platforms to industrial control systems and telecommunications equipment. The open‑source nature of the operating system means that many organizations rely on rapid patch cycles from distributors such as Red Hat, Ubuntu, and SUSE. CISA recommends that administrators verify they are running the latest kernel packages from their vendor, and that they conduct thorough log reviews for signs of suspicious activity, especially any unexpected privilege‑escalation attempts.

Industry experts say the timing of the advisory underscores a growing trend: attackers are increasingly targeting the underlying operating system rather than just applications. “Kernel‑level exploits give adversaries deep, persistent footholds,” said a senior analyst at a cybersecurity consultancy who asked to remain unnamed. “The fact that these exploits are already in use suggests a level of sophistication that could impact both private enterprises and government agencies.”

The advisory also provides guidance on mitigation steps beyond patching, such as enabling kernel hardening options, employing mandatory access controls, and isolating critical workloads in containers or virtual machines. Organizations that cannot patch immediately are urged to apply temporary work‑arounds where available and to monitor network traffic for anomalous patterns that could indicate exploitation attempts.

Looking ahead, CISA plans to track the deployment of patches and will issue follow‑up notices if additional evidence of exploitation emerges. The agency’s broader push to improve the nation’s cyber resilience includes a coordinated effort with the Department of Homeland Security and industry partners to share threat intelligence on Linux‑related attacks. As the ecosystem prepares to roll out updates, officials stress that swift action is essential to prevent attackers from leveraging these kernel weaknesses to compromise essential services.