CISA Warns of Active Exploitation of Three Linux Kernel Vulnerabilities

On Tuesday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) released a high‑priority advisory indicating that threat actors are actively exploiting three recently disclosed Linux kernel vulnerabilities. The notice calls on every operator of Linux‑based environments to promptly install patches and start probing for possible compromise.

The vulnerabilities—CVE‑2025‑39682, CVE‑2026‑53266 and CVE‑2025‑39964—target essential kernel subsystems responsible for memory management and process scheduling. CISA notes that these flaws can be combined to produce privilege escalation, enabling an adversary with limited foothold to seize root‑level authority.

This advisory represents the inaugural inclusion of these CVEs in CISA’s Known Exploited Vulnerabilities (KEV) catalog, which enumerates flaws seen in active attacks. The agency further reports that exploit code for the three bugs has already been observed in the wild, without revealing the responsible groups or campaigns. Labeling the issues as “actively exploited” conveys a high risk rating and underscores the need for immediate remediation.

A wide range of critical infrastructure—including web servers, cloud services, industrial control systems and telecom gear—relies on Linux. Because the OS is open source, numerous entities depend on swift patch releases from distributors like Red Hat, Ubuntu and SUSE. CISA advises administrators to confirm they are using the newest kernel packages supplied by their vendor and to perform comprehensive log examinations for any anomalous activity, particularly unexpected privilege‑escalation attempts.

Experts in the field note that the advisory’s timing highlights a rising pattern: threat actors are focusing more on the operating system itself instead of merely on applications. “Kernel‑level exploits give adversaries deep, persistent footholds,” said a senior analyst at a cybersecurity consultancy who asked to remain unnamed. “The fact that these exploits are already in use suggests a level of sophistication that could impact both private enterprises and government agencies.”

Beyond patching, the notice outlines additional mitigation measures, including activating kernel hardening features, using mandatory access controls, and sandboxing critical workloads within containers or virtual machines. Entities unable to apply patches right away are encouraged to implement any available temporary work‑arounds and to scrutinize network traffic for irregular patterns that might signal exploitation attempts.

Going forward, CISA intends to monitor patch adoption and will release follow‑up alerts should further exploitation evidence surface. This initiative forms part of the agency’s larger effort to boost national cyber resilience, working alongside the Department of Homeland Security and industry collaborators to exchange threat intelligence on Linux‑focused attacks. As the ecosystem readies its updates, officials emphasize that rapid response is crucial to stop adversaries from exploiting these kernel flaws to jeopardize vital services.