[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKede5cdr6rlOv6FgTUJYzQ3y_CiuFWQJctGdw7MHvo8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":49},"70b728bc-5d78-46c1-885d-a766a5822cfb","14-year-old-linux-kernel-flaw-among-three-actively-exploited-vulnerabilities","fc8b4894-2ecf-4db3-8408-9adfaaee5283","14-Year-Old Linux Kernel Flaw Among Three Actively Exploited Vulnerabilities","Three Linux kernel vulnerabilities, including one that has existed unpatched for 14 years, are being actively exploited in the wild — underscoring the dangers of deferred patch cycles and inadequate vulnerability tracking programs. The critical flaw (CVE-2025-39964) enables privilege escalation and container escape, meaning attackers can break out of isolated environments and gain elevated system access. CISA's addition of these to its Known Exploited Vulnerabilities (KEV) catalog signals real-world threat actor activity, not just theoretical risk. Organizations that lack continuous vulnerability scanning or rely on manual patching processes are especially exposed. This incident highlights that long-lived, unaddressed vulnerabilities remain high-value targets for threat actors who actively monitor public disclosures.","**Immediate actions:**\n- Apply the latest Linux kernel patches addressing CVE-2025-39964 and the two related flaws across all affected systems without delay.\n- Cross-reference your asset inventory against CISA's Known Exploited Vulnerabilities (KEV) catalog to identify any exposed systems immediately.\n- Restrict privileges on Linux systems to limit the blast radius of any successful privilege escalation attempt.\n\n**Long-term improvements:**\n- Establish a formal vulnerability management program with SLA-driven patch timelines based on CVSS severity and active exploitation status.\n- Implement automated, continuous vulnerability scanning across all Linux endpoints and container environments.\n- Enforce a container security policy that prevents privilege escalation and restricts container escape vectors at the kernel level (e.g., seccomp, AppArmor, SELinux).\n\n**Detection measures:**\n- Deploy endpoint detection and response (EDR) tooling capable of identifying kernel-level exploitation techniques and anomalous privilege changes.\n- Monitor system logs for unexpected privilege escalations, container breakout attempts, or unusual kernel module loading events.\n- Subscribe to CISA KEV catalog alerts and threat intelligence feeds to receive timely notification of newly exploited vulnerabilities.",[12,13,14,15,16,17,18,19,20],"CIS Control 7 - Continuous Vulnerability Management","CIS Control 4 - Secure Configuration of Enterprise Assets","NIST SP 800-40 Rev. 4 - Guide to Enterprise Patch Management","NIST SI-2 - Flaw Remediation","NIST CM-6 - Configuration Settings","NIST AC-6 - Least Privilege","CISA KEV Catalog Compliance Directive (BOD 22-01)","ITIL Change Management - Emergency Change Procedures","NIST SP 800-190 - Application Container Security Guide",{},"published","2026-09-21T22:20:38.76904+00:00","2026-09-21T22:20:38.454+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-alerts-of-active-exploitation-of-three-linux-kernel-flaws\u002F","cisa-alerts-of-active-exploitation-of-three-linux-kernel-flaws-522af8","CISA alerts of active exploitation of three Linux kernel flaws",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[43],{"id":44,"date":45,"edition":46,"title":47,"audio_url":48},"e5e752e4-9ee9-4b24-979e-435c24ee7ac2","2026-09-22","morning","ThreatNoir Morning Brief — September 22","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-09-22\u002Fthreatnoir-morning-brief-2026-09-22.mp3",[50,53,56],{"slug":33,"name":51,"problem":52},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":39,"name":54,"problem":55},"Automated patch management","Known holes get closed in days, not months.",{"slug":57,"name":58,"problem":59},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them."]