The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has urgently escalated three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, declaring them actively exploited in the wild and necessitating immediate, emergency patch management.
The most severe of the trio, CVE-2025-39682, carries a critical CVSS score of 9.8. This flaw in the kernel's TLS receive path—stemming from an improper check for exceptional conditions—allows potential system compromise. Its inclusion in the KEV catalog, backed by evidence of active attacks, moves the required response from a scheduled update to a high-priority incident.
CISA's catalog, maintained under Binding Operational Directive (BOD) 22-01, legally requires U.S. federal agencies to remediate listed vulnerabilities within strict timelines. Its presence is globally recognized by security teams as a definitive indicator of real-world, weaponized vulnerabilities. The addition of three kernel flaws at once underscores their severity and widespread impact.
While full technical details on the two other listed kernel CVEs are pending, the confirmed exploitation of the critical TLS flaw highlights a persistent adversary focus on undermining foundational, open-source infrastructure. The kernel's TLS implementation secures communications for countless servers, making such vulnerabilities high-value targets.
System administrators and DevOps teams must treat this as a critical incident response operation. The confirmed, active attacks demand a three-step defensive surge:
- Immediate Audit: Conduct an emergency inventory of all Linux systems to identify vulnerable kernel versions affected by CVE-2025-39682 and the associated CVEs.
- Expedited Patching: Apply security updates from Linux distribution vendors without delay, bypassing standard change windows if necessary. The active threat landscape makes rapid patching the primary mitigation.
- Enhanced Monitoring: Bolster network monitoring for anomalous TLS activity that could signal exploitation attempts in real time, complementing the patch deployment.
The public confirmation of exploitation transforms this advisory from a routine bulletin into a directive for swift action. For local IT teams, rapidly deploying these patches is now the single most effective measure to defend systems against a known, active threat. Continued vigilance for updates on the additional CVEs is also advised.
美國網絡安全和基礎設施安全局（CISA）已緊急將三個Linux內核漏洞提升至其「已知被利用漏洞」（KEV）目錄，宣布它們在野外正遭活躍利用，需要立即進行緊急補丁管理。
這三個漏洞中最嚴重的是CVE-2025-39682，其CVSS評分高達9.8的「嚴重」級別。該漏洞存在於內核的TLS接收路徑中——源於對異常條件的檢查不當——可能導致系統被入侵。鑒於有主動攻擊的證據，該漏洞被納入KEV目錄，意味著所需的回應從按計劃更新提升為高優先級事件。
CISA的目錄根據《具有約束力的操作指令》（BOD）22-01維護，法律上要求美國聯邦機構在嚴格的時間表內修補目錄中列出的漏洞。安全團隊普遍認為，該目錄的存在是現實世界中、已被武器化的漏洞的明確指標。此次一次性添加三個內核漏洞，凸顯了其嚴重性和廣泛影響。
儘管另外兩個已列入的內核CVE的完整技術細節尚待公布，但已確認被利用的嚴重TLS漏洞凸顯了持續存在的對手破壞基礎、開源基礎設施的重點關注。內核的TLS實現為無數伺服器保護通訊安全，使得這類漏洞成為高價值攻擊目標。
系統管理員和DevOps團隊必須將此視為關鍵事件回應操作。已證實的主動攻擊要求採取三步緊急防禦措施：
- 緊急審計： 對所有Linux系統進行緊急盤點，識別受CVE-2025-39682及相關CVE影響的脆弱內核版本。
- 加速修補： 立即應用Linux發行版供應商提供的安全更新，如有必要可繞過標準變更窗口。主動威脅形勢下，快速修補是首要緩解措施。
- 加強監控： 加強網絡監控，實時偵測可能表示攻擊嘗試的異常TLS活動，以補充補丁部署。
利用行為的公開確認，將此公告從例行通報轉變為要求迅速行動的指令。對於本地IT團隊而言，快速部署這些補丁現已成為防禦已知、活躍威脅的最有效單一措施。同時也建議持續關注其他CVE的更新資訊。