CISA Warns of Active Exploitation in Two Linux Kernel Flaws

CISA has confirmed active exploitation of two Linux kernel vulnerabilities: CVE-2025-39964, rated 7.8 (high) under CVSSv3, and CVE-2026-53266, rated 8.8. The flaws affect unpatched Linux kernel trees, particularly systems using the relevant cryptographic user API or customised bridge packet filters. The report says exploitation could disrupt systems or enable local privilege escalation, although it does not identify the attackers or provide evidence detailing the campaigns.

CVE-2025-39964 is a race condition in the AF_ALG cryptographic user API. Two writers using the same socket can cause request payloads to interleave unpredictably, potentially corrupting cryptographic results or triggering denial-of-service conditions. CVE-2026-53266 affects the netfilter bridge ebtables SNAT target.

When rewriting address ranges in nonlinear network fragments, the driver can copy data into memory pages without checking that they are writable; the report describes this as allowing a local attacker to escalate privileges.

Administrators should install their distribution’s latest kernel updates. The listed fixes include commits 0f28c4adbc4a97437874c9b669fd7958a8c6d6ce, e4c1ec11132ec466f7362a95f36a506ce4dc08c9, 1f323a48e9b5ebfe6dc7d130fdf5c3c0e92a07c8 and 7c4491b5644e3a3708f3dbd7591be0a570135b84 for CVE-2025-39964, plus bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87, 76280b78cc9f23bdc6438e10ad6dff148ef8375b and b7e91939ba9be805a62a257fa4e227dffbb88fa0 for CVE-2026-53266. If patching is not immediately possible, the report recommends blacklisting `af_alg` and disabling ARP hardware-address rewriting in ebtables rules.