CISA Flags Active Exploitation of Linux Kernel Vulnerabilities

CISA has listed three actively exploited Linux kernel vulnerabilities (including CVE-2025-39964, a race condition in AF_ALG sockets) in its Known Exploited Vulnerabilities catalog; the flaws can lead to crashes, DoS, and local privilege escalation, and Red Hat has issued advisories while federal agencies are mandated to apply patches by September 21, 2026. The vulnerabilities mainly affect multi-tenant Linux servers, container hosts, and systems running untrusted local code, and researchers are continuing to monitor exploitation activity.