CISA Orders Emergency Patches for Actively Exploited Linux Vulnerabilities

The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to take urgent action against three vulnerabilities affecting the Linux kernel. The vulnerabilities were added to CISA’s Known Exploited Vulnerabilities catalogue after evidence indicated that they were being exploited in real-world attacks. The agency’s unusually short remediation deadline reflected the level of risk associated with the flaws.

The vulnerabilities are identified as CVE-2025-39682, CVE-2026-53266 and CVE-2025-39964. They affect different components of the Linux kernel, including the kernel’s TLS implementation, ebtables networking functionality and a user-space cryptographic interface. Security researchers and Red Hat advisories have described the vulnerabilities as requiring urgent attention, with available fixes for affected systems.

CISA’s Known Exploited Vulnerabilities catalogue is specifically designed to identify security weaknesses for which there is credible evidence of exploitation. Under CISA’s current risk-based vulnerability management framework, federal civilian agencies are expected to prioritise these vulnerabilities based on factors such as exploitation, internet exposure and the potential impact of a successful attack.

The agency’s action also highlights a broader shift in how organisations are being encouraged to respond to cybersecurity vulnerabilities. Rather than relying only on traditional severity ratings, CISA’s 2026 directive places greater emphasis on whether a vulnerability is actually being exploited and what level of control an attacker could obtain. CISA has encouraged organisations outside the federal government to adopt the same risk-based approach even though the binding directive applies specifically to federal civilian agencies.

The latest warning reinforces the importance of keeping Linux systems and other internet-connected infrastructure updated. Organisations using affected Linux distributions should apply the security updates provided by their vendors and review systems for signs of compromise where exploitation is known or suspected. CISA continues to update its catalogue as new evidence of active exploitation emerges, making rapid vulnerability management an increasingly important part of cybersecurity operations.