CISA Adds Three Actively Exploited Linux Kernel Flaws to KEV List

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) announced on Friday that it has placed three recently disclosed Linux kernel vulnerabilities into its Known Exploited Vulnerabilities (KEV) catalog, confirming that threat actors are already leveraging the flaws in the wild. One of the identifiers, CVE-2025-39682, was highlighted alongside two additional kernel weaknesses that have not been publicly named.

The KEV program is designed to give federal agencies and private organizations a clear signal about which vulnerabilities pose the most immediate risk. By flagging a vulnerability as “known exploited,” CISA urges rapid remediation, because the presence of active attacks raises the likelihood of widespread compromise. Linux’s kernel underpins a vast array of servers, cloud platforms, embedded devices, and network infrastructure, making any breach at that level potentially far‑reaching.

Kernel vulnerabilities differ from typical application bugs in that they grant attackers low‑level access to the operating system core. Exploits can enable privilege escalation, code execution, or denial‑of‑service conditions, allowing malicious actors to take control of entire systems. The fact that these three flaws are already being weaponized suggests that adversaries have developed reliable exploit code and are targeting environments that run unpatched Linux distributions.

Following CISA’s alert, major Linux vendors and downstream distributors have begun releasing patches and security advisories. System administrators are being advised to apply the updates as soon as they become available, verify that their package repositories are current, and consider additional mitigations such as kernel lockdown modes or mandatory access controls while patches are deployed. Organizations that cannot update immediately should monitor network traffic for indicators of compromise associated with known exploit patterns.

Looking ahead, CISA said it will continue to track activity around the three kernel bugs and update the KEV list as new information emerges. The agency’s inclusion of these flaws underscores the broader challenge of maintaining security across the heterogeneous Linux ecosystem, where many devices run older kernels that may lack timely updates. Prompt patching and vigilant monitoring remain the most effective defenses against the escalating threat of kernel‑level attacks.