Linux Kernel Flaws Under Active Exploitation: CISA Adds Three to KEV as Public Root Exploits Surface
Linux Kernel Flaws Under Active Exploitation: CISA Adds Three to KEV as Public Root Exploits Surface
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation — while in the same week a security researcher published working exploit code for four more kernel flaws that each hand a local user root access. Federal agencies have until September 21, 2026 to patch the KEV trio under Binding Operational Directive 26-04.
The three newly cataloged flaws are:
- CVE-2025-39682 (CVSS 9.8) — an improper check for unusual or exceptional conditions in the TLS receive path that could allow local authenticated users to trigger memory disclosure or denial of service.
- CVE-2026-53266 (CVSS 8.8) — an out-of-bounds write in the ebtables SNAT ARP rewrite path that could allow a local attacker to trigger unintended system behavior, DoS, or local privilege escalation.
- CVE-2025-39964 (CVSS 7.8) — a race condition allowing concurrent writes to the same AF_ALG socket, letting a local attacker crash the system or corrupt cryptographic operation results.
There are no details yet on how the three are being exploited or whether they are being weaponized as a single attack chain. Red Hat, however, updated advisories for all three flaws on September 19 to acknowledge active exploitation. "This CVE is high risk and there are known public exploits leveraging this vulnerability," Red Hat said. "Address this vulnerability with high priority."
Four Public Root Exploits Land in the Same Week
The KEV additions come as researcher Asim Manizada released a technical write-up with working public exploits for four local privilege escalation flaws he reported to the kernel security team in mid-July: DirtyAH6 (CVE-2026-80844, IPsec AH6/IPv6), TUNderflow (CVE-2026-81000, TUN/TAP devices), PPPoEject (CVE-2026-68121, PPPoE), and DiagSpill (CVE-2026-74469, SCTP reporting code).
All four are memory-safety bugs in the kernel's networking code, and the underlying mistakes are old — ranging from 10 to 21 years. Three of the four can be reached by an ordinary user only when unprivileged user namespaces are enabled, which many distributions turn on by default. DiagSpill is the exception: it requires no special privileges as long as the SCTP module is available. There are no reports of the four being used in real-world attacks yet, and the exploits are tuned to specific kernel builds and can crash machines, but public code sharply raises the risk on shared systems. The first stable kernel releases carrying all four fixes are 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, and 7.2.4.
Manizada found the flaws with an AI-assisted process that maps how the kernel handles memory — the DirtyAH6 fix commit includes an "Assisted-by" line crediting his custom AI tooling. He says this batch likely ends the public phase of his AI-assisted bug hunting.
What Should You Do?
- Patch to a kernel that carries the fixes — and check your distribution's advisory. FCEB agencies have a September 21 deadline for the KEV trio; everyone else should treat both sets as high priority. Match against your distro's security advisory rather than mainline version numbers.
- If you cannot patch right away, disable unprivileged user namespaces. This closes the ordinary-user path to DirtyAH6, TUNderflow, and PPPoEject. It does not stop DiagSpill or processes that already hold network-admin privileges.
- Turn off features you do not use: AH6, TUN/TAP, PPPoE, and SCTP. Manizada recommends patching over disabling, because other paths to the same flaws may exist.
- Prioritize multi-tenant and shared systems. Local privilege escalation matters most where an attacker already holds a low-privileged foothold — a web shell, a compromised CMS account, or a container escape — and wants full control.
The WAF Angle
A WAF will never see a kernel exploit fire — but it sees the first half of the chain that usually precedes one. The realistic path to root on a Linux web host starts at the application layer: an injected web shell or an abused upload gives the attacker a low-privileged shell, and kernel LPE flaws like these convert that foothold into full system control. That makes kernel patching part of application defense, not separate from it. Two more lessons stand out. First, Red Hat's "known public exploits" language means the window between disclosure and weaponization is effectively zero — detection rules and rollback plans matter as much as patches. Second, the AI-assisted discovery trend means kernel 0-day output is industrializing; defenders should assume the supply of memory-safety bugs will grow, and audit features like unprivileged user namespaces — the same setting that governs container-adjacent risk on web-hosting stacks — as a standing hardening measure.
