CTI · reported · 2026-09-21

CISA: Three Linux Kernel Flaws Actively Exploited in the Wild

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1068 Exploitation for Privilege Escalation Privilege Escalation

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: CISA KEV - Three Linux Kernel Vulnerabilities Actively Exploited
id: 7a2c1d3e-8f4b-4c5a-9d6e-1f2a3b4c5d6e
status: experimental
description: Detects exploitation attempts for CVE-2025-39682 (kTLS zero-length record), CVE-2025-39964 (AF_ALG race condition), and CVE-2026-53266 Linux kernel vulnerabilities added to CISA KEV catalog. Confirmed actively exploited in the wild.
references:
  - https://heise.de
  - https://securityweek.com
  - https://cyber.netsecops.io
author: Tia N. List
date: 2026-09-21
tags:
  - attack.initial_access
  - attack.privilege_escalation
  - CVE.2025.39682
  - CVE.2025.39964
  - CVE.2026.53266
logsource:
  category: process_creation
  product: linux
detection:
  selection_ktls:
    CommandLine|contains: 'setsockopt'
    CommandLine|contains|all:
      - 'IPPROTO_TLS'
      - 'TLS_TX'
  selection_afalg:
    CommandLine|contains: 'AF_ALG'
    CommandLine|contains: 'bind'
  selection_kernel_mod:
    CommandLine|contains|all:
      - 'insmod'
      - 'modprobe'
    CommandLine|contains:
      - 'tcp_diag'
      - 'x_tables'
      - 'nf_conntrack'
  condition: selection_ktls or selection_afalg or selection_kernel_mod
falsepositives:
  - Legitimate kernel module loading during system startup
  - TLS configuration scripts
level: high

References

• https://heise.de
• https://securityweek.com
• https://cyber.netsecops.io