CVE-2025-39964Active Exploitation(linux / linux_kernel)

CRITICALCVSS 5.5 · MEDIUMCISA KEV

Exploitation observed; activity peaked at 17 mentions and remains active

Immediate actions

Patch linux linux_kernel systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

linux CVEs Back to dashboard

9.5/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-21. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Patch / fix

Vendor / third-party advisories

Other references

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964

Weakness type (CWE)

CWE-362

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

linux_kernel
simatic_s7-1500_cpu_1518-4_pn\/dp_mfp
simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware
simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp

Threat summary

Active exploitation appears in 75 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
89 mentions across 19 observed days

What's happening

Active exploitation reported across 75 signals
Exploit tool or code specified in 5 signals
PoC mentioned or linked in 8 signals
Patch or workaround mentioned in 42 signals
Technical details provided in 70 signals
Disclosure: 5 classified signals
Peaked 16d ago at 17 mentions (2026-09-20); latest day: 1
89 total mentions across 19 days

Affected systems

Vendors

linux siemens

Products

linux_kernelsimatic_s7-1500_cpu_1518-4_pn\/dp_mfpsimatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmwaresimatic_s7-1500_cpu_1518f-4_pn\/dp_mfpsimatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware

1 version affected across 5 products

Deep dive

Activity timeline89 mentions / 19d

Signal classification6 categories

Active Exploitation

7584.3%

Disclosure

55.6%

Patch

44.5%

Exploit

22.2%

General

22.2%

PoC

11.1%

Referenced assets40 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-18	12	Active Exploitation12
2026-09-19	13	Active Exploitation11Disclosure2
2026-09-20	17	Active Exploitation15Disclosure1Patch1
2026-09-21	11	Active Exploitation11
2026-09-22	12	Active Exploitation9Exploit1General1Patch1
2026-09-23	5	Active Exploitation4Patch1
2026-09-24	1	Disclosure1
2026-09-25	5	Active Exploitation2Disclosure1Patch1PoC1
2026-09-26	2	Exploit1General1
2026-09-27	1	Active Exploitation1
2026-09-28	1	Active Exploitation1
2026-09-29	1	Active Exploitation1
2026-09-30	1	Active Exploitation1
2026-10-01	1	Active Exploitation1
2026-10-02	1	Active Exploitation1
2026-10-03	1	Active Exploitation1
2026-10-05	2	Active Exploitation2
2026-10-23	1	Active Exploitation1
2026-10-30	1	Active Exploitation1

Full discourse20 posts

Mr.Niko@_MrNiko40d
PoC
unprivileged user. AF_ALG race. root. $113,337. CVE-2025-39964. two sendmsg() calls share one socket. wait path drops the lock. merge stays true while cur is 0. next append reads sg[-1]. that becomes a kernel write. core_pattern pipe. root. also a Docker host escape. same family as Copy Fail. different bug. in the tree since 2011. credit: Muhammad Alifa Ramdhan / STAR Labs https://idnsec.com/research/linux-local-privilege-escalation-with-af-alg/ #Linux #ExploitDev #InfoSec
Post summary
The tweet announces CVE-2025-39964, a Linux kernel local privilege escalation via AF_ALG race condition, and shares a link to a research article containing technical details and likely PoC.
0170132678.1K
1.6K followersView on X
Ratan Jyoti@reach2ratan45d
Active Exploitation
🚨 ROOT ON YOUR LINUX BOXES: Check your kernels right now. CISA just threw multiple Linux privilege escalation bugs (CVE-2026-53266, CVE-2025-39964, CVE-2025-39682) into the Known Exploited Vulnerabilities catalog under emergency mandates. What’s happening? Attackers who already have unprivileged shell access are exploiting memory corruption bugs—specifically an out-of-bounds write in the ebtables network rewrite path and race conditions in socket handling—to jump straight from low-level access to full root or crash host servers into a denial of service. How to detect it: • Hunt for unprivileged accounts spawning unexpected root shells via auditd (execve where uid > 1000 spawns euid=0). • Check dmesg / kernel logs for memory panics, segfaults around ebtables, or socket teardown stack traces. • Watch for anomalous process trees emerging from unprivileged web service users (e.g., www-data invoking /bin/bash as root). How to mitigate: • Patch immediately: Apply the latest kernel updates from your distro vendor (RHEL, Ubuntu, Debian, SUSE) and reboot. • Disable unprivileged user namespaces if not strictly needed: sysctl -w kernel.unprivileged_userns_clone=0 (or user.max_user_namespaces=0). • Restrict ebtables / network namespace access to trusted admins via SELinux/AppArmor policies. Indicators of Compromise (IoCs): • File System / Ephemeral Execution: High-entropy or packed ELF executables executing from /dev/shm/, /tmp/, or /var/tmp/ with subsequent setuid(0) calls. Unexpected creation of persistent suid binaries: find / -perm -4000 -exec ls -ld {} +. • Audit & Telemetry Signatures: auditd event logs showing non-root processes invoking unshare(CLONE_NEWUSER) or clone(CLONE_NEWUSER). Kernel ring buffer (dmesg) crashes with tainted flags (kernel NULL pointer dereference, ebtables: table entry out of bounds, or socket refcount underflows). • Behavioral Traces: YARA Rule: rule Linux_Kernel_LPE_Exploit_Artifacts { meta: description = "Detects generic local privilege escalation artifacts targeting kernel socket/ebtables" author = "SecOps" severity = "high" strings: $s1 = "/sbin/ebtables" ascii $s2 = "/proc/self/ns/user" ascii $S3 = "commit_creds" ascii $s4 = "prepare_kernel_cred" ascii $elf = { 7F 45 4C 46 } condition: $elf at 0 and ($s1 or $s2) and ($S3 or $s4) and filesize < 5MB } Low-privilege service accounts (www-data, nobody, container runtimes) spawning /bin/sh, /bin/bash, or python interactive pty shells with uid=0. Audit your clusters today—once an attacker gets a foothold, local root is practically instant. #CyberSecurity #Linux #Infosec #ZeroDay #ThreatIntel #PatchTuesday #CISA
Post summary
The post alerts that CISA has listed multiple Linux kernel privilege‑escalation CVEs in its KEV catalog due to active exploitation via out‑of‑bounds writes and race conditions, and urges immediate patching and specific mitigations.
02003110987
26.9K followersView on X
starlabs@starlabs_sg40d
Disclosure
@n0psledbyte audited AF_ALG, a Linux subsystem letting unprivileged users knock on the kernel's crypto door since 2011. CVE-2025-39964: race condition, sg[-1] dereference, arbitrary write, root, Docker escape. @st424204 helped complete the exploit chain. kernelCTF: $113,337.
Post summary
The tweet discloses CVE-2025-39964, detailing a race condition in AF_ALG that allows arbitrary write, root access, and Docker escape, noting assistance in completing the exploit chain and a kernelCTF bounty, without mentioning patches or exploit tools.
1203562.5K
10.4K followersView on X
CISA Cyber@CISACyber46d
Active Exploitation
🛡 We added Linux Kernal race condition vulnerability CVE-2025-39964 & out-of-bounds write vulnerability CVE-2026-53266 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/SpBCm1GlhM
Post summary
The tweet announces that CVE-2025-39964 (Linux Kernel race condition) and CVE-2026-53266 (out-of-bounds write) were added to the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and directs organizations to apply mitigations. Both CVEs have their vulnerability types described, and no PoC or exploit tool is mentioned.
1502457.5K
303.4K followersView on X
Igor Os@igor_os77745d
Active Exploitation
CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild | The Hacker News https://buff.ly/mEL1vEp • CVE-2025-39682 (CVSS 9.8) — Improper check for unusual or exceptional conditions in the TLS receive path; lets local authenticated users trigger memory disclosure or denial-of-service. • CVE-2026-53266 (CVSS 8.8) — Out-of-bounds write in the ebtables SNAT ARP rewrite path; enables unintended system behavior, DoS, or local privilege escalation. • CVE-2025-39964 (CVSS 7.8) — Race condition permitting concurrent writes to the same AF_ALG socket, causing crashes or corrupted cryptographic results (DoS or data integrity loss).
Post summary
CISA has flagged three Linux kernel vulnerabilities (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) as actively exploited in the wild, posing risks including memory disclosure, local privilege escalation, and denial-of-service.
2201131.0K
27.7K followersView on X
kokumօtօ@__kokumoto46d
Active Exploitation
米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに2件と1件の脆弱性を追加。全てLinuxカーネルで、CVE-2025-39964、CVE-2026-53266、CVE-2025-39682。対処期限は3日後の9/21。ランサムウェアによる悪用は不知。 https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-one-known-exploited-vulnerability-catalog
Post summary
Three Linux kernel CVEs (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) were added to CISA's known exploited vulnerabilities catalog with a 3-day action deadline, but no specific patches, PoCs, or technical details are shared in the text. Ransomware exploitation status remains unconfirmed.
210781.5K
7.8K followersView on X
Dark Web Intelligence@DailyDarkWeb46d
Active Exploitation
🚨 CISA ADDS LINUX KERNEL TLS CVE-2025-39682 TO KEV CISA has added CVE-2025-39682 (Linux Kernel TLS) to its Known Exploited Vulnerabilities Catalog (2026-09-18; catalog count noted at 1716) based on evidence of active exploitation. Per CISA / technical notes: • Improper check in the Linux Kernel TLS receive path • A zero-length record from rx_list can bypass intended recvmsg() record-type handling • Due date: 2026-09-21 · Forensic triage required: Yes ⚠️ Analyst Note: This is a THIRD same-day Linux Kernel KEV addition — distinct from today’s earlier pair (CVE-2025-39964 + CVE-2026-53266). Official CISA active-exploitation listing: patch ASAP and follow BOD 26-04 forensic-triage guidance where applicable. CISA alert: https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-one-known-exploited-vulnerability-catalog KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Kernel fix example: https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-39682 #DDW #DarkWeb #CVE #Linux #KEV #ThreatIntelligence #CyberSecurity
Post summary
CISA has added CVE-2025-39682 (Linux Kernel TLS) to its Known Exploited Vulnerabilities catalog based on confirmed evidence of active exploitation in the wild, with specific technical details about a receive-path improper check and an explicit directive to patch immediately.
110826.4K
209.0K followersView on X
Valen@ValenSecurity42d
Active Exploitation
cisa metió tres fallas del kernel de linux en el catálogo kev: tls (CVE-2025-39682), af_alg (CVE-2025-39964) y ebtables (CVE-2026-53266). las tres son locales y la de ebtables puede terminar en root. a las agencias federales les dio tres días para parchear
Post summary
CISA added three local Linux kernel vulnerabilities to its KEV catalog, including one that may lead to root access via ebtables, and set a three-day patch deadline for federal agencies. The main takeaway is that these issues are being treated as actively exploited.
00073600
6.5K followersView on X
Dr. Mazin Al-Busaidi@mazin_dr3873744d
Active Exploitation
🚨 تحذير عاجل من CISA! 🚨 ثلاث ثغرات خطيرة في نواة Linux يتم استغلالها الآن في هجمات حقيقية! ⚠️ 🔴 CVE-2025-39682 - الأخطر! خلل في مسار استقبال TLS 🔴 CVE-2026-53266 🔴 CVE-2025-39964 أُضيفت للقائمة السوداء في 18 سبتمبر 2026 ⏰ الموعد النهائي للإصلاح: 21 سبتمبر 2026 فقط! 🛡️ إذا كنت تدير أنظمة Linux، قم بالتحديث الفوري الآن! لا تنتظر حتى يفوت الأوان 🔥 🔗 http://cybersecuritynews.com #cybersecuritynews #Linux #CISA #CyberSecurity #أمن_المعلومات #ثغرات_أمنية
Post summary
The tweet alerts that three Linux kernel vulnerabilities (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) have been added to the CISA KEV catalog as of Sept 18, 2026, are actively exploited in the wild, and require immediate patching by Sept 21, 2026.
04060130
1.2K followersView on X
Dark Web Intelligence@DailyDarkWeb46d
Active Exploitation
🚨 CISA ADDS TWO LINUX KERNEL VULNS TO KEV CATALOG CISA has added two Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation (catalog date 2026-09-18). CVEs added: • CVE-2025-39964 — race condition (AF_ALG socket concurrent writes / state inconsistency) • CVE-2026-53266 — out-of-bounds write (ebtables SNAT target writing into nonlinear skb fragment) Due date: 2026-09-21 · Forensic triage required: Yes · Known ransomware use: Unknown ⚠️ Analyst Note: This is an official CISA KEV addition reflecting active exploitation evidence — not an unverified underground claim. Organizations should prioritize patching per BOD 26-04 guidance and vendor/kernel updates. CISA alert: https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog #DDW #DarkWeb #CISA #KEV #Linux #CyberSecurity
Post summary
CISA officially added two Linux kernel vulnerabilities (CVE-2025-39964 and CVE-2026-53266) to its KEV catalog based on confirmed evidence of active exploitation, with a patch due date of 2026-09-21 and forensic triage recommended per BOD 26-04.
100625.8K
209.0K followersView on X
Brahim@IBthecoder38d
Active Exploitation
A 14-year-old Linux kernel flaw can now be exploited to gain ROOT access. And in certain Docker environments, it can potentially let an attacker escape the container and compromise the host. The vulnerability is CVE-2025-39964, a race condition in Linux's AF_ALG cryptographic interface. The vulnerable code was introduced back in Linux 2.6.38 in 2011 and remained exposed for roughly 14 years. Security researcher Muhammad Alifa Ramdhan discovered the issue while auditing the Linux kernel for Google's kernelCTF program. The bug allows two threads to interact with the same AF_ALG socket at the wrong time, causing the kernel's internal state to become inconsistent. Researchers turned that race condition into an out-of-bounds access and ultimately developed a way to gain arbitrary kernel write access. The exploit then targets core_pattern, a Linux kernel setting that controls how core dumps are handled. By manipulating it and triggering a crash, the proof of concept can execute attacker-controlled code with ROOT privileges. But it gets even more interesting with containers. Docker containers share the host's Linux kernel. So if an attacker can exploit the vulnerable kernel from inside an affected container, the same kernel-level primitive can potentially be used to escape the container and gain root access to the host. The researchers developed the exploit for Google's kernelCTF program and reportedly received a $113,337 reward. CVE-2025-39964 is also listed in CISA's Known Exploited Vulnerabilities catalog. If you manage Linux servers or container infrastructure: • Update your kernel through your Linux distribution • Reboot into the patched kernel • Prioritize container hosts and shared infrastructure • Check systems where untrusted local code can execute • Verify that the running kernel actually contains the fix A vulnerability doesn't have to be new to become dangerous. Sometimes the biggest story is what was hiding in the code for years. 🔗 Full technical research: https://idnsec.com/research/linux-local-privilege-escalation-with-af-alg/ 🔗 Google kernelCTF research: https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2025-39964_lts_cos_mitigation 🔗 Linux CVE advisory: https://lists.openwall.net/linux-cve-announce/2025/10/13/2 #Linux
Post summary
The text reports on CVE-2025-39964, a Linux kernel race condition, explicitly noting its inclusion in CISA's Known Exploited Vulnerabilities catalog as evidence of exploitation. It details the exploit mechanism (AF_ALG race, core_pattern), links to a PoC, and recommends kernel updates.
20050222
412 followersView on X
Venkata Satish Guttula 🛰️@snakeyesV145d
Active Exploitation
News: CISA added 3 Linux kernel flaws to KEV. Attackers exploit CVE-2025-39682 (9.8), CVE-2026-53266, and CVE-2025-39964. Patch kernels now. Hunt local privilege jumps. US federal deadline is 21 Sept. https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html
Post summary
CISA added three Linux kernel CVEs (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to its KEV catalog with active exploitation reported, and urges immediate kernel patching before a 21 Sept federal deadline.
11130284
3.1K followersView on X
VulnTracker@vuln_tracker46d
Active Exploitation
Three Linux kernel vulnerabilities. All confirmed exploited by CISA on the same day. CVE-2025-39682 (CVSS 9.8): a remotely triggerable flaw in the TLS receive path. CVE-2026-53266 (8.8): an out-of-bounds write in netfilter's ebtables ARP rewrite. CVE-2025-39964 (7.8): a race condition in AF_ALG sockets that corrupts crypto operations. Federal deadline: September 21. If you run Linux, patch now. Details: http://vulntracker.io #Linux #CVE #CISA #VulnTracker
Post summary
The post alerts that three Linux kernel vulnerabilities have been added to the CISA KEV catalog, confirming active exploitation, and urges immediate patching to meet a federal deadline.
00060377
832 followersView on X
セキュリティ対策Lab@securityLab_jp43d
Active Exploitation
CISA、Linux Kernelの脆弱性　CVE-2025-39964・CVE-2026-53266・CVE-2025-39682のサイバー攻撃での悪用を確認、KEVカタログに追加 https://rocket-boys.co.jp/security-measures-lab/cisa-linux-cve-2025-39964-catalog-update/ #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース #脆弱性
Post summary
CISA confirmed active exploitation of Linux kernel CVEs CVE-2025-39964, CVE-2026-53266, and CVE-2025-39682 and added them to its KEV catalog, with no PoC, exploit tool, patch, or technical details mentioned.
01031482
3.6K followersView on X
National CERT/CC@CERT_UG43d
Active Exploitation
Patch Now | September 21, 2026 CVE-2025-39682 (CVSS 9.8): TLS receive path flaw, actively exploited. CVE-2026-53266 (CVSS 8.8): ebtables ARP rewrite memory corruption. CVE-2025-39964 (CVSS 7.8): AF_ALG race condition, data integrity risk. https://cert.ug | #CyberSafe https://t.co/UISlGgIYWe
Post summary
The tweet announces three CVEs, highlights that CVE-2025-39682 is actively exploited, provides CVSS scores and short technical descriptions, and urges patching without naming a specific fix.
01130351
1.5K followersView on X
كاسبر سكاي@KasperskyDev43d
Active Exploitation
ثلاث ثغرات في نواة لينكس أُضيفت إلى قائمة الثغرات المستغلة فعلياً. المعرّفات : CVE-2025-39682 CVE-2026-53266 CVE-2025-39964 درجة الخطورة : 9.8 / 8.8 / 7.8 (CVSS) الحالة : Actively exploited الرابط :
Post summary
The post reports that three Linux kernel CVEs have been added to the actively exploited list, providing their identifiers and CVSS scores, but does not mention PoCs, exploit tools, patches, or debunking claims.
11010304
39.9K followersView on X
RichTechGuy@richtechguy44d
Active Exploitation
CISA KEV: three Linux kernel bugs under active exploitation—CVE-2025-39682 (TLS path, 9.8), CVE-2026-53266 (ebtables SNAT), CVE-2025-39964 (AF_ALG race). Federal due date Sep 21 under BOD 26-04. Prioritize distro kernel updates and triage exposed hosts. https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html
Post summary
CISA has added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities catalog, confirming active exploitation and mandating federal agencies to apply distribution kernel updates by September 21 per BOD 26-04.
20010109
359 followersView on X
PCMedicalist@PCMedicalist45d
Active Exploitation
PCMedicalist Signal · Sep 19 CVE-2025-39964 is now in CISA KEV--Linux Kernel Race Condition, a privileged function with no auth in front of it. We've built agent systems and on-chain infrastructure on Blue-Team discipline for 17 years. PCMedicalist · https://pcmedicalist.com/intel https://t.co/IAoTFsCPH7
Post summary
The tweet announces CVE-2025-39964's inclusion in the CISA KEV catalog, confirming active exploitation of a Linux Kernel race condition involving an unauthenticated privileged function.
0003059
192 followersView on X
LinuxSecurity@lnxsec33d
Active Exploitation
A kernel mitigation that breaks an unused interface can be excellent. The same mitigation applied to a hidden dependency can become an outage. Red Hat lists preventing the `af_alg` module from loading as a mitigation for CVE-2025-39964. That is useful only after confirming the workload does not depend on it. **In practical terms, it is a good time to:** • identify whether `af_alg` is modular or built into the running kernel • test application crypto paths before blacklisting the module • record the mitigation as temporary and track replacement with a fixed kernel #LinuxSecurity #LinuxHardening #KernelSecurity https://linuxsecurity.com/news/hackscracks/actively-exploited-linux-af-alg-cve-2025-39964
Post summary
The text notes that Red Hat recommends mitigating CVE-2025-39964 by blocking the af_alg module while also indicating the vulnerability is actively exploited via a linked article. It advises checking module usage and planning a fixed kernel deployment.
10010102
4.6K followersView on X
Trio Soft inc@triosoftinc42d
Active Exploitation
CISA gave federal agencies three days to patch three Linux kernel flaws. CVE-2025-39682 at CVSS 9.8 in the TLS receive path. CVE-2025-39964 in AF_ALG sockets. CVE-2026-53266 in ebtables SNAT. Two of the three are 2025 CVEs. The fixes are old, the exploitation isn't. #Linux https://t.co/Ob8m8dbJ8v
Post summary
CISA has mandated a three-day patch deadline for three high-severity Linux kernel vulnerabilities (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266), noting that while the fixes are old, active exploitation is ongoing.
1001062
28 followersView on X

CPE platform detail11 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

11 of 11 entries

Part	Vendor	Product	Version	Target SW	Target HW
OS	linux	linux_kernel	-	-	-
OS	linux	linux_kernel	6.17	-	-
OS	linux	linux_kernel	6.17	-	-
OS	linux	linux_kernel	6.17	-	-
OS	linux	linux_kernel	6.17	-	-
OS	linux	linux_kernel	6.17	-	-
OS	linux	linux_kernel	6.17	-	-
HW	siemens	simatic_s7-1500_cpu_1518-4_pn\/dp_mfp	-	-	-
OS	siemens	simatic_s7-1500_cpu_1518-4_pn\/dp_mfp_firmware	-	-	-
HW	siemens	simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp	-	-	-
OS	siemens	simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware	-	-	-

Explore more

Back to dashboard linux CVEs siemens CVEs linux_kernel vulnerabilities

What researchers are saying

CVE-2025-39964

Mr.Niko[verified]@_MrNikoPoC

The tweet announces CVE-2025-39964, a Linux kernel local privilege escalation via AF_ALG race condition, and shares a link to a research article containing technical details and likely PoC.

Ratan Jyoti[verified]@reach2ratanActive Exploitation

The post alerts that CISA has listed multiple Linux kernel privilege‑escalation CVEs in its KEV catalog due to active exploitation via out‑of‑bounds writes and race conditions, and urges immediate patching and specific mitigations.

Igor Os[verified]@igor_os777Active Exploitation

CISA has flagged three Linux kernel vulnerabilities (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) as actively exploited in the wild, posing risks including memory disclosure, local privilege escalation, and denial-of-service.

kokumօtօ[verified]@__kokumotoActive Exploitation

Three Linux kernel CVEs (CVE-2025-39964, CVE-2026-53266, CVE-2025-39682) were added to CISA's known exploited vulnerabilities catalog with a 3-day action deadline, but no specific patches, PoCs, or technical details are shared in the text. Ransomware exploitation status remains unconfirmed.

Dark Web Intelligence[verified]@DailyDarkWebActive Exploitation

CISA has added CVE-2025-39682 (Linux Kernel TLS) to its Known Exploited Vulnerabilities catalog based on confirmed evidence of active exploitation in the wild, with specific technical details about a receive-path improper check and an explicit directive to patch immediately.

Valen[verified]@ValenSecurityActive Exploitation

CISA added three local Linux kernel vulnerabilities to its KEV catalog, including one that may lead to root access via ebtables, and set a three-day patch deadline for federal agencies. The main takeaway is that these issues are being treated as actively exploited.

Dr. Mazin Al-Busaidi[verified]@mazin_dr38737Active Exploitation

The tweet alerts that three Linux kernel vulnerabilities (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) have been added to the CISA KEV catalog as of Sept 18, 2026, are actively exploited in the wild, and require immediate patching by Sept 21, 2026.

Dark Web Intelligence[verified]@DailyDarkWebActive Exploitation

CISA officially added two Linux kernel vulnerabilities (CVE-2025-39964 and CVE-2026-53266) to its KEV catalog based on confirmed evidence of active exploitation, with a patch due date of 2026-09-21 and forensic triage recommended per BOD 26-04.