Three Linux kernel flaws reportedly added to CISA’s actively exploited list
SecurityUnverifiedUpdated:
Three Linux kernel vulnerabilities—rated from medium to critical—have reportedly moved from known security issues to CISA-listed actively exploited flaws, triggering urgent federal remediation requirements.
Updates and investigation of prior exploitation for three flaws
According to the report, CISA separately added CVE-2025-39964, CVE-2026-53266, and CVE-2025-39682 last week. It says the agency considers all three exploited in attacks and directed federal agencies to apply available updates or mitigations by the stated deadline, while examining affected assets for signs of prior exploitation. The report says no incident details or threat-actor information were disclosed.
Before their reported additions, these three Linux kernel issues were not described in the supplied report as all carrying CISA's highest-priority federal remediation and forensic-triage requirements.
The report says CISA added three Linux kernel vulnerabilities to its actively exploited list and assigned them highest priority for federal agencies, including patching or mitigation and forensic triage of affected assets.
One flaw reportedly existed for 14 years
The reported change applies an active-exploitation designation and forensic-triage requirement to three Linux kernel flaws at once. One, CVE-2025-39964, is described as having existed in the kernel for 14 years.
Sources
- BleepingComputerCISA alerts of active exploitation of three Linux kernel flawsRead source →