Linux flaws being used in attacks
CISA lists 31 flaws in Linux products as being used in attacks, most recently on 18 Sep 2026. 2 have been used in ransomware.
LinuxBeing used in attacks
- On CISA’s list
- 31 flaws, added between 10 Dec 2021 and 18 Sep 2026
- Most recent
- CVE-2026-53266, Linux Kernel Out-of-Bounds Write Vulnerability, added 18 Sep 2026
- Used in ransomware
- 2 flaws, according to CISA
- Products
- Kernel (31)
What to do
- Update every Linux product you use.Install the updates Linux offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Linux Kernel
CVE-2026-53266Linux Kernel Out-of-Bounds Write VulnerabilityLinux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Linux Kernel
CVE-2025-39964Linux Kernel Race Condition VulnerabilityLinux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Linux Kernel
CVE-2025-39682Linux Kernel Improper Check for Unusual or Exceptional Conditions VulnerabilityLinux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Linux Kernel
CVE-2026-53362Linux Kernel Unspecified VulnerabilityLinux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Linux Kernel
CVE-2022-0995Linux Kernel Out-of-Bounds Write VulnerabilityLinux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Linux Kernel
CVE-2022-0492Linux Kernel Improper Authentication VulnerabilityLinux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Linux Kernel
CVE-2026-31431Linux Kernel Incorrect Resource Transfer Between Spheres VulnerabilityLinux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.CISA’s required action"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Linux Kernel
CVE-2018-14634Linux Kernel Integer Overflow VulnerabilityLinux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Linux Kernel
CVE-2021-22555Linux Kernel Heap Out-of-Bounds Write VulnerabilityLinux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Linux Kernel
CVE-2025-38352Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition VulnerabilityLinux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Linux Kernel
CVE-2023-0386Linux Kernel Improper Ownership Management VulnerabilityLinux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Linux Kernel
CVE-2024-53197Linux Kernel Out-of-Bounds Access VulnerabilityLinux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Linux Kernel
CVE-2024-53150Linux Kernel Out-of-Bounds Read VulnerabilityLinux Kernel contains an out-of-bounds read vulnerability in the USB-audio driver that allows a local, privileged attacker to obtain potentially sensitive information.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Linux Kernel
CVE-2024-50302Linux Kernel Use of Uninitialized Resource VulnerabilityThe Linux kernel contains a use of uninitialized resource vulnerability that allows an attacker to leak kernel memory via a specially crafted HID report.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Linux Kernel
CVE-2024-53104Linux Kernel Out-of-Bounds Write VulnerabilityLinux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Linux Kernel
CVE-2017-1000253Linux Kernel PIE Stack Buffer Corruption VulnerabilityLinux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Linux Kernel
CVE-2022-0185Linux Kernel Heap-Based Buffer Overflow VulnerabilityLinux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable. - Linux Kernel
CVE-2022-2586Linux Kernel Use-After-Free VulnerabilityLinux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable. - Linux Kernel
CVE-2024-1086Linux Kernel Use-After-Free VulnerabilityLinux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Linux Kernel
CVE-2014-0196Linux Kernel Race Condition VulnerabilityLinux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Linux Kernel
CVE-2010-3904Linux Kernel Improper Input Validation VulnerabilityLinux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Linux Kernel
CVE-2023-0266Linux Kernel Use-After-Free VulnerabilityLinux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.CISA’s required actionApply updates per vendor instructions. - Linux Kernel
CVE-2021-3493Linux Kernel Privilege Escalation VulnerabilityThe overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.CISA’s required actionApply updates per vendor instructions. - Linux Kernel
CVE-2013-6282Linux Kernel Improper Input Validation VulnerabilityThe get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.CISA’s required actionApply updates per vendor instructions. - Linux Kernel
CVE-2013-2596Linux Kernel Integer Overflow VulnerabilityLinux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Linux Kernel
CVE-2013-2094Linux Kernel Privilege Escalation VulnerabilityLinux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Linux Kernel
CVE-2014-3153Linux Kernel Privilege Escalation VulnerabilityThe futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.CISA’s required actionApply updates per vendor instructions. - Linux Kernel
CVE-2022-0847Linux Kernel Privilege Escalation VulnerabilityLinux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of "Dirty Pipe."CISA’s required actionApply updates per vendor instructions. - Linux Kernel
CVE-2021-22600Linux Kernel Privilege Escalation VulnerabilityLinux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Linux Kernel
CVE-2016-5195Linux Kernel Race Condition VulnerabilityRace condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.CISA’s required actionApply updates per vendor instructions. - Linux Kernel
CVE-2019-13272Linux Kernel Improper Privilege Management VulnerabilityKernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Linux on CISA’s site.