CISA flags active exploitation of Linux kernel flaws in AF_ALG, ebtables and kTLS

CISA confirms active exploitation of three kernel flaws

CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, which means the agency has evidence the bugs are being exploited in the wild. According to BleepingComputer, whose September 21 report is summarized on dev.to, the affected subsystems are the AF_ALG cryptographic interface, the ebtables SNAT implementation and the kernel TLS receive path. As usual with KEV entries, CISA has not named the attackers, the victims or the techniques involved, so defenders have to work from the technical details of each bug.

CVE-2025-39964: AF_ALG race condition

AF_ALG is the kernel interface that lets user-space programs use kernel cryptographic algorithms. According to the reporting, concurrent writes to the same AF_ALG socket by a low-privileged local user or a process inside a container can trigger a race condition that leaves the socket's internal state inconsistent, causing system crashes or corrupted cryptographic results. Researchers at STAR Labs demonstrated privilege escalation and container escape with this bug in the kernelCTF environment. That is a test-environment result: it proves the bug is exploitable, not that real attackers have achieved the same outcome.

CVE-2026-53266: ebtables SNAT memory corruption

The second flaw affects the ebtables SNAT code. In setups with specific bridge netfilter and ebtables SNAT rules, a low-privileged attacker can abuse the path that rewrites ARP source hardware addresses to modify a shared page that was not marked writable. The consequence is memory corruption, denial of service and potential local privilege escalation. Public analysis cited in the reporting infers a privilege-escalation route with similarities to Dirty Pipe, but a stable public exploit has not been demonstrated, so the escalation potential remains inferred rather than proven.

CVE-2025-39682: remotely triggerable kTLS bug

The third flaw is the one to look at first from an exposure standpoint, because it does not require any local access. Specially crafted TLS records sent to a network service that uses kernel TLS hit a bug in how zero-length records are handled in the receive queue, causing different record types to be processed by the same recvmsg() call. Red Hat states that remote triggering is possible, though the impact observed in real attacks has not been published.

Patching and interim mitigations

The definitive fix is to apply the vendor patch or backported fix and reboot into the updated kernel. Until that is done, Red Hat advises two interim measures: prevent the tls kernel module from loading, and remove ebtables SNAT rules that rewrite ARP hardware addresses. There is no equally simple mitigation for the AF_ALG flaw, which makes patching the only practical option there.

For detection, the reporting suggests correlating kernel faults with activity in the affected subsystems: kernel oops and KASAN/BUG events, unusual AF_ALG socket activity, ebtables rule changes, and processes that gain UID 0 or move into host namespaces immediately after a fault. On the network side, abnormal TLS records, resets, retransmissions and crashes of kTLS services are the signals to review.

Why it matters

Two of the three flaws only need a low-privileged foothold, and such footholds are cheap to obtain in shared and containerized environments — precisely where the demonstrated AF_ALG container escape bites hardest. The third can be triggered remotely against any reachable kTLS service. A KEV listing is CISA's strongest public signal that a vulnerability is being abused, and while the real-world outcomes are undisclosed, the instruction for operators is unambiguous: inventory kernel versions, check whether AF_ALG, ebtables SNAT or kTLS are in use, patch, reboot, and hunt for evidence of earlier exploitation.