CISA Adds Three Linux Kernel Flaws to Exploited Catalog Amid Active Attacks

WASHINGTON — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three critical vulnerabilities in the Linux kernel to its Known Exploited Vulnerabilities catalog, citing confirmed evidence of active exploitation in the wild. The update, released Friday morning, marks a significant escalation in the threat landscape for government agencies, businesses, and infrastructure operators relying on Linux-based systems.

The agency identified the flaws as being actively weaponized by threat actors targeting federal networks and private sector entities. CISA's directive requires federal civilian agencies to remediate these specific issues immediately, aligning with the agency's broader mandate to eliminate known exploited vulnerabilities across the government ecosystem within 100 days of catalog inclusion.

The three vulnerabilities affect core components of the Linux kernel, the foundational software layer that manages hardware resources and system operations for millions of servers, cloud instances, and embedded devices globally. While CISA did not disclose the specific CVE identifiers in its initial public statement, the agency emphasized that unpatched systems are currently at risk of compromise.

Security researcher Asim Manizada played a key role in identifying the mechanics behind these flaws. His analysis highlighted how attackers could leverage the bugs to gain unauthorized access or execute arbitrary code on vulnerable machines. Red Hat, a major developer and distributor of enterprise Linux distributions, has issued urgent advisories urging customers to apply available patches immediately. The company confirmed that its engineering teams are working closely with CISA to ensure remediation guidance reaches affected users.

The timing of the alert comes as cybersecurity officials warn of a surge in sophisticated attacks targeting open-source infrastructure. Unlike previous incidents where vulnerabilities remained theoretical until patched, these flaws have already been observed in active campaigns. The exploitation appears to target systems that have not yet received the latest security updates, leaving a window of opportunity for malicious actors.

Federal agencies are now scrambling to scan their networks and deploy patches across their Linux environments. The pressure is particularly acute for organizations managing critical infrastructure, where downtime or data breaches could have cascading effects on public services.

While CISA has confirmed the active nature of these exploits, questions remain regarding the full scope of the campaigns and the specific threat groups responsible. It is unclear whether the attacks are isolated incidents or part of a coordinated effort by state-sponsored actors. Additionally, the extent of compromise in private sector networks remains unknown as organizations conduct internal assessments.

Security experts advise that patching alone may not be sufficient if systems have already been infiltrated. Comprehensive incident response measures, including network monitoring and forensic analysis, are recommended for any organization running affected versions of the Linux kernel. As the situation develops, CISA expects to provide further updates on the threat actors involved and additional mitigation strategies.