Latest / The Digital Warfare Podcast / EP. 166: Three Linux Kernel Vulnerabilities Added to CISA’s Exploited List
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we're looking at something that sits underneath an enormous amount of modern infrastructure, the Linux kernel. Security authorities are warning organizations about three Linux kernel vulnerabilities that have now been added to CISA's known exploited vulnerabilities catalog. The vulnerabilities are CVE-2025-39682, CVE-2026-53266. And CVE-2025-39964. Here's what happened. These are not three versions of the same vulnerability. They affect different areas of the Linux kernel and create different security consequences. Let's start with CVE-2025-39682. This vulnerability affects how the Linux kernel handles zero-length records in its TLS receive path. The technical problem involves an unusual condition during re-CVMSG processing. Under the affected condition, the kernel can incorrectly handle a zero-length TLS record after zero copy decryption. The consequences can include improper memory behavior and denial of service. Now consider CVE-2026-53266. This one affects Linux Netfilter, specifically the bridge EB Table's SNAT functionality used with ARP traffic. The floor can allow a local attacker operating under specific bridge networking conditions to improperly modify underlying memory pages. Red Hat says the consequences can include memory corruption, denial of service, and potentially local privilege escalation. There is an important limitation. This is not simply an unauthenticated attacker somewhere on the internet sending one packet and becoming root. The attack requires local access and specific bridge net filter conditions, but those conditions matter in environments that make heavy use of Linux networking, virtualization, and containers. The third vulnerability is CVE-2025-39964. It affects the kernel's AF underscore ALG cryptographic interface. The underlying problem involves concurrent rights to the same AF underscore ALG socket. Those rights can become interleaved and create inconsistencies in the socket's internal state. The kernel fix prevents concurrent rights by enforcing exclusive ownership during the operation. So why should organizations care about three very different bugs? Because they share one extremely important characteristic. They are no longer theoretical. CISA has placed them in the known exploited vulnerabilities catalog. That means defenders should prioritize them based on evidence of real-world exploitation rather than CVSS scores alone, and Linux is everywhere. Web servers, cloud infrastructure, container hosts, CI/CD systems, virtualization platforms, security appliances, development systems, and critical back-end infrastructure. But defenders should also avoid another mistake. Do not assume every Linux machine is equally vulnerable. Kernel vulnerabilities are highly dependent on the actual kernel version, distribution, configuration, and enabled functionality. For example, CVE-2026-53266 requires specific bridge net filter conditions. Different Linux distributions also backport security fixes. That means checking only the apparent kernel version can sometimes produce the wrong conclusion. So what should defenders do? First, Identify the Linux systems running in your environment, not just servers. Include container hosts, development infrastructure, CI/CD runners, and appliances where the underlying operating system is visible and manageable. Second, check each distribution's security advisory. Ubuntu, Red Hat, Debian, and other distributions maintain their own vulnerability status and patched package information. Third, apply the vendor-supplied kernel update. And remember that installing a new kernel package is only part of the process. The system normally needs to boot into the patched kernel before the vulnerable running kernel has actually been replaced. Fourth, verify the running version after remediation. A successful package installation does not necessarily mean the active kernel changed. And finally, treat active exploitation as a prioritization signal. Thousands of vulnerabilities are disclosed, only a subset become known exploitation targets. That's why defenders should combine severity with exploit intelligence, exposure, and business criticality. And that is today's larger lesson. Patch management is not simply about chasing the highest C VSS number. It is about understanding what attackers are actually using. Know your Linux state. Know your running kernels. Prioritize exploited vulnerabilities. Patch. Reboot where required and verify. Because a vulnerability isn't fixed simply because the update was downloaded. It is fixed when the vulnerable code is no longer running. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.