CISA Adds Actively Exploited Linux Kernel Flaws to Known Exploited Vulnerabilities Catalog

En bref

• CISA added Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog.
• The flaws are being actively exploited, though no CVE IDs or specific versions were provided.
• Kernel-level exploits can give attackers full control of affected systems.
• Federal agencies face remediation deadlines; all organizations should prioritize updates.
• Watch for vendor advisories and kernel patches from Linux distributions.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) catalog with entries concerning the Linux kernel. This action indicates that the agency has evidence of active exploitation. No CVE identifiers were included in the atomic facts, and the scale remains unspecified.

Any organization running Linux—servers, cloud workloads, appliances, embedded devices—could be at risk. The Linux kernel underpins much of modern infrastructure, from web servers to Android devices. Federal agencies are directly mandated to act, but private sector and education entities should treat this as a high-priority alert.

Kernel flaws are especially dangerous because they operate at the lowest level of the operating system. Successful exploitation can lead to privilege escalation, data theft, ransomware deployment, or complete system takeover. Because Linux powers critical services, a single unpatched host can become a pivot point for broader network compromise.

CISA's KEV catalog is an authoritative list of vulnerabilities that have been exploited in the wild. Adding Linux kernel issues signals that attackers are actively targeting these flaws. While the specific flaws are not detailed here, historically kernel vulnerabilities have been used by advanced persistent threats and commodity malware alike.

Expect Linux distribution vendors (Red Hat, Canonical, SUSE, Debian) to release updated kernels. Monitor CISA's KEV catalog for deadlines. Also watch for proof-of-concept exploits or reports of widespread scanning. Organizations should prepare for emergency patching and potential reboots.

À faire maintenant

1. Immediately inventory all Linux systems and note kernel versions.
2. Apply the latest kernel security updates from your distribution vendor without delay.
3. Schedule reboots to activate new kernels; use live patching where available but do not rely solely on it.
4. Monitor system logs and network traffic for signs of exploitation, such as unexpected privilege escalation or outbound connections.
5. Restrict local and remote access to kernel interfaces where possible (e.g., disable unneeded modules).
6. Review CISA's KEV catalog for specific remediation deadlines and align your patching SLAs.
7. If you cannot patch immediately, consider isolating critical systems or applying vendor mitigations.

Source originale

Security Affairs