Urgent Security Directive Issued

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent directive to federal agencies following the discovery of three Linux kernel vulnerabilities that are currently being targeted in the wild. These security defects have been formally added to the agency's [CISA’s KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) list. Due to the active nature of the exploitation, officials have mandated that all affected government organizations implement necessary patches within a three-day window.

Critical TLS Path Vulnerability

The most severe of the identified issues is [CVE-2025-39682](https://www.cve.org/CVERecord?id=CVE-2025-39682), which carries a critical CVSS score of 9.8. This vulnerability resides within the Linux kernel’s handling of zero-length records on the rx_list during the Transport Layer Security (TLS) receive path. Security researchers noted that a logical error in the recvmsg() function allows an attacker to break out of the standard processing loop.

Under specific conditions involving zero-copy decryption, the kernel incorrectly assumes that no type change can occur after the initial decryption process. By utilizing a zero-length record, a local attacker can exploit this flawed assumption to trigger a denial-of-service (DoS) condition or perform memory disclosure, potentially exposing sensitive information stored in user-space buffers.

Race Conditions and Data Integrity

The second issue addressed in the recent warning is [CVE-2025-39964](https://www.cve.org/CVERecord?id=CVE-2025-39964), which has been assigned a CVSS score of 7.8. This flaw is identified as a race condition occurring when two separate writes are issued simultaneously to the same AF_ALG socket. This specific interaction leads to data being interleaved in an unpredictable manner, compromising the internal consistency of the socket's state.

This inconsistency is significant because it can lead to system crashes or the corruption of cryptographic operation results. Because these operations are fundamental to maintaining secure communications and system stability, the resulting errors frequently manifest as denial-of-service conditions, further emphasizing the need for timely remediation.

Memory Corruption Risks

Finally, [CVE-2026-53266](https://www.cve.org/CVERecord?id=CVE-2026-53266) is an out-of-bounds write vulnerability located within the bridge Netfilter ebtables Source Network Address Translation (SNAT) target, bearing a CVSS score of 8.8. The defect occurs when an Address Resolution Protocol (ARP) sender hardware address is written directly into a nonlinear socket-buffer fragment.

This flaw allows an attacker to provide a specially crafted packet containing an ARP payload to trigger an unsafe write operation. This action facilitates unauthorized memory modification outside the boundaries of the intended packet buffer, leading to system-level memory corruption. While the technical details of the actual exploitation remain limited, the potential for arbitrary memory manipulation makes this a high-priority risk for network administrators.

Broader Security Context

As reported by [SecurityWeek](https://www.securityweek.com/organizations-warned-of-3-exploited-linux-kernel-vulnerabilities/), these findings arrive during a period of heightened activity regarding kernel-level vulnerabilities. Organizations are encouraged to regularly monitor the KEV catalog and apply manufacturer-supplied updates as soon as they become available to prevent exploitation by malicious actors who frequently pivot between different vulnerabilities to gain system access.

Sources

• SecurityWeekOrganizations Warned of 3 Exploited Linux Kernel Vulnerabilities