Skip to navigation

Threat reportVulnerabilityTL-2026-2582

CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities: kTLS Receive-Path Disclosure/DoS, ebtables SNAT Privilege Escalation, and AF_ALG Race Condition (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964)

criticalACTIVE

CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on September 18, 2026 after Red Hat confirmed known public exploits: a critical kTLS receive-path memory disclosure/DoS flaw (CVE-2025-39682, CVSS 9.8), an ebtables SNAT ARP-rewrite out-of-bounds write enabling local privilege escalation (CVE-2026-53266, CVSS 8.8), and an AF_ALG socket race condition corrupting cryptographic operations (CVE-2025-39964, CVSS 7.8).

Key facts for Linux kernel KEV flaws

IdentifiersTL-2026-2582, CVE-2025-39682, CVE-2026-53266, CVE-2025-39964
SeverityCRITICAL
CVSS9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Exploitation statusExploited in the wild; Listed in CISA KEV: CVE-2025-39682 (added ), CVE-2026-53266 (added ), CVE-2025-39964 (added )
EPSSCVE-2025-39682: 2.8% (86.4th percentile); CVE-2025-39964: 1.2% (69.0th percentile); CVE-2026-53266: 0.8% (56.2th percentile)
Affected productsLinux Linux Kernel -- kTLS / net/tls receive path; Linux Linux Kernel -- netfilter bridge ebtables SNAT (ebt_snat.c); Linux Linux Kernel -- AF_ALG crypto socket interface (crypto/af_alg.c); Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Siemens Industrial/embedded products using affected Linux kernel versions (Siemens ProductCERT SSA-032379, SSA-019113)
Weaknesses (CWE)CWE-754, CWE-825, CWE-787, CWE-362, CWE-366, CWE-416, CWE-125
MITRE ATT&CK techniquesT0814 Denial of Service, T0866 Exploitation of Remote Services, T0890 Exploitation for Privilege Escalation, T1040 Network Sniffing, T1046 Network Service Discovery, T1068 Exploitation for Privilege Escalation, T1082 System Information Discovery, T1106 Native API, T1190 Exploit Public-Facing Application, T1210 Exploitation of Remote Services, T1211 Exploitation for Stealth, T1212 Exploitation for Credential Access and 10 more in the attack flow
MotivationUNKNOWN
Target sectorsgovernment administration, industrial, critical infrastructure, technology
Target regionsNorth America, Global
Detection rules9 (1 shown free)
Sources18 cited sources

Detection coverage for Linux kernel KEV flaws

As of 2026-09-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2582 across Splunk SPL, Microsoft KQL and Sigma, covering 57 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: kTLS Receive-Path Kernel Crash — Zero-Length TLS Record Exploitation (CVE-2025-39682)

Detects kernel oops/panic/KASAN signatures referencing the kTLS software receive path (net/tls/tls_sw.c, tls_sw_recvmsg) on hosts that offload TLS decryption to the kernel (TCP_ULP=tls). This is the crash/disclosure signature of CVE-2025-39682, a CISA KEV-listed, remotely triggerable improper-condition-check flaw where a zero-length TLS record retrieved from the socket rx_list bypasses record-type handling in recvmsg(), causing memory disclosure or denial-of-service on internet-facing kTLS-offload services.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1046, T1040, T1499.004
  • Data sources: linux_kernel_syslog, auditd, netflow, device_network_events
  • Severity: critical
  • Confidence: high

Splunk SPL

index=linux_servers (sourcetype=syslog OR sourcetype=linux_secure) (facility=kern OR source="/var/log/kern.log" OR source="/var/log/messages")
("tls_sw_recvmsg" OR "net/tls/tls_sw.c" OR ("KASAN" AND "tls") OR ("general protection fault" AND "tls_sw") OR "kernel BUG at net/tls/tls_sw.c")
| rex field=_raw "(?<crash_class>BUG:\s+KASAN[^\n]+|general protection fault[^\n]*|kernel BUG at [^\s]+)"
| eval ktls_signature=if(match(_raw, "(?i)tls_sw_recvmsg|net/tls/tls_sw\.c"), 1, 0)
| where ktls_signature=1
``` correlate with prior TLS-offload service exposure recon on the same host in the preceding 15 minutes ```
| join type=left host
    [ search index=network_flows sourcetype=netflow dest_port IN (443, 8443, 993, 995) earliest=-15m
      | stats count as tls_port_probes dc(src_ip) as distinct_scanners by host ]
| stats count as crash_events min(_time) as first_seen max(_time) as last_seen values(crash_class) as crash_signatures values(tls_port_probes) as prior_port_probes by host
| where crash_events>=1
| eval severity=if(prior_port_probes>0, "critical_likely_remote_exploit", "critical_crash_confirmed")
| table host, crash_events, first_seen, last_seen, crash_signatures, prior_port_probes, severity

Microsoft KQL

let KernelCrashes = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("KernelPanic", "KernelError", "LinuxKernelLog")
| where AdditionalFields has_any ("tls_sw_recvmsg", "net/tls/tls_sw.c", "KASAN")
| extend CrashSignature = extract(@"(BUG: KASAN[^\r\n]+|general protection fault[^\r\n]*|kernel BUG at [^\s]+)", 1, tostring(AdditionalFields))
| where AdditionalFields has "tls_sw_recvmsg" or AdditionalFields has "net/tls/tls_sw.c";
let TlsPortProbes = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (443, 8443, 993, 995)
| summarize ProbeCount = count(), DistinctSources = dcount(RemoteIP) by DeviceId, bin(Timestamp, 15m);
KernelCrashes
| join kind=leftouter (TlsPortProbes) on DeviceId
| summarize CrashEvents = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), CrashSignatures = make_set(CrashSignature), PriorProbes = sum(ProbeCount) by DeviceId, DeviceName
| where CrashEvents >= 1
| extend Severity = iff(PriorProbes > 0, "critical_likely_remote_exploit", "critical_crash_confirmed")
| project DeviceName, DeviceId, CrashEvents, FirstSeen, LastSeen, CrashSignatures, PriorProbes, Severity

Sigma

title: Linux Kernel kTLS Receive-Path Crash (CVE-2025-39682)
id: b7f2c9a4-3d1e-4a6b-8c5f-2e9d7a1b4c60
status: experimental
description: Detects kernel panic/oops/KASAN signatures in the software kTLS receive path (net/tls/tls_sw.c, tls_sw_recvmsg), the crash indicator for the CVE-2025-39682 zero-length TLS record disclosure/DoS flaw on kTLS-offload-enabled services.
references:
  - https://access.redhat.com/security/cve/cve-2025-39682
  - https://bugzilla.redhat.com/show_bug.cgi?id=2393511
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-19
tags:
  - attack.initial-access
  - attack.t1190
  - attack.discovery
  - attack.t1046
  - attack.credential-access
  - attack.t1040
  - attack.impact
  - attack.t1499.004
  - cve.2025.39682
logsource:
  product: linux
  service: kernel
detection:
  selection_signature:
    message|contains:
      - 'tls_sw_recvmsg'
      - 'net/tls/tls_sw.c'
  selection_crash:
    message|contains:
      - 'BUG: KASAN'
      - 'general protection fault'
      - 'kernel BUG at'
  condition: selection_signature and selection_crash
falsepositives:
  - Kernel fuzzing/syzkaller test infrastructure intentionally exercising the kTLS receive path
  - Legitimate kernel debugging with CONFIG_DEBUG_TLS or KASAN instrumentation enabled in non-production builds
level: critical

Known false positives:

  • Kernel fuzzing/syzkaller harnesses intentionally driving the kTLS receive path
  • Debug/KASAN-instrumented non-production kernel builds logging benign kTLS warnings

Tuning notes: Scope the netflow/DeviceNetworkEvents join to hosts confirmed to have CONFIG_TLS/TCP_ULP=tls kTLS offload enabled (cross-reference against an asset inventory of kTLS-consuming services) to cut noise from unrelated TLS-terminating hosts; widen the join lookback window past 15m in high-latency scan environments.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • kTLS Receive-Path [indicator] Crash — Zero-Length [indicator] Record Exploitation (CVE-2025-39682) · unlock with TL Creds
  • ebtables SNAT ARP Sender-Hardware-Address Rewrite Privilege Escalation Attempt (CVE-2026-53266) · unlock with TL Creds
  • [indicator] Vulnerability Recon Followed by [indicator] Concurrent-Write Race Exploitation (CVE-2025-39964) · unlock with TL Creds
  • kTLS Receive-Path [indicator] Crash — Zero-Length [indicator] Record Exploitation (CVE-2025-39682) · unlock with TL Creds
  • ebtables SNAT ARP Sender-Hardware-Address Rewrite Privilege Escalation Attempt (CVE-2026-53266) · unlock with TL Creds
  • [indicator] Vulnerability Recon Followed by [indicator] Concurrent-Write Race Exploitation (CVE-2025-39964) · unlock with TL Creds
  • ebtables SNAT ARP Sender-Hardware-Address Rewrite Privilege Escalation Attempt (CVE-2026-53266) · unlock with TL Creds
  • [indicator] Vulnerability Recon Followed by [indicator] Concurrent-Write Race Exploitation (CVE-2025-39964) · unlock with TL Creds

Indicators of compromise for Linux kernel KEV flaws

As of 2026-09-27, Threadlinqs Intelligence tracks 57 indicators of compromise for TL-2026-2582.

Sample indicators (3 of 57)

  • URL: hxxps://github[.]com/n1k0oowang/CVE-2025-39964_EXP
  • File hash: 2902c3ebcca52ca845c03182000e8d71d3a5196f
  • URL: hxxps://github[.]com/suominen/CVE-2025-39964

Defanged, TLP:CLEAR. Full set of 57 indicators: unlock with TL Creds.

57 indicators of compromise · unlock with TL Creds. Compare plans

How Linux kernel KEV flaws works

FCEB agencies face a September 21, 2026 remediation deadline under BOD 26-04.

On September 18, 2026, CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after Red Hat updated its security advisories at 02:00 UTC on September 19, 2026 to confirm 'known public exploits' targeting all three flaws. Federal Civilian Executive Branch (FCEB) agencies face a Binding Operational Directive (BOD) 26-04 remediation deadline of September 21, 2026, and CISA's KEV notes require forensic triage of potentially exposed assets rather than patch-only remediation.

CVE-2025-39682 (CVSS 9.8 per the CVE Numbering Authority; NVD separately scores it 7.1 under a local-vector interpretation) is an improper-condition-check flaw (CWE-754) in the Linux kernel's software kernel TLS (kTLS) receive path, in net/tls/tls_sw.c. A zero-length TLS record retrieved from the socket's rx_list bypasses the intended record-type handling in recvmsg(), breaking the invariant that a single receive operation processes either contiguous data records or one non-data record, and leaving subsequent records processed under incorrect zero-copy/queueing assumptions. Because kTLS moves TLS record decryption into the kernel for any TCP socket with TCP_ULP set to 'tls', Red Hat confirms the bug 'can be remotely triggered only when kernel TLS ... is in use' -- making internet-facing services that offload TLS decryption to the kernel remotely exploitable for memory disclosure or denial-of-service. Interim mitigation is blacklisting the tls kernel module (Red Hat solution 41278).

CVE-2026-53266 (CVSS 8.8 per CNA; CWE-825 Expired Pointer Dereference per Red Hat, CWE-787 Out-of-Bounds Write per NVD) affects the netfilter bridge ebtables SNAT target's optional ARP sender-hardware-address (SHA) rewrite path in net/bridge/netfilter/ebt_snat.c. The code safely reads the ARP header with skb_header_pointer() but then calls skb_store_bits() to rewrite the SHA without first verifying the destination range is writable; when that range falls inside a nonlinear socket-buffer fragment backed by a splice-imported file page, the write lands directly on the underlying page. Red Hat's bug tracker (BZ#2485368) attributes the regression to commit 63137bc5882a, which fixed an unrelated small-packet issue but introduced this memory-safety gap, and notes the resulting corruption can extend to file-backed memory, cross-process corruption via vmsplice(), or use-after-free conditions -- consistent with the CNA's CVSS vector recording Scope:Changed. Exploitation requires a local attacker on a system with bridge netfilter rules configured to perform ARP SHA rewriting, and requires CAP_NET_ADMIN capability to configure the ebtables SNAT rule in the first place -- a prerequisite that concentrates real-world risk in container and virtualization hosts using bridge networking, where a namespaced or delegated CAP_NET_ADMIN is common; impact ranges from crash to local privilege escalation, with NVD's Scope:Changed rating reflecting the documented cross-process memory corruption when affected pages are shared via vmsplice(). Red Hat shipped fixes via RHSA-2026:36645 (RHEL 9) and RHSA-2026:39082/RHSA-2026:39083 (RHEL 8); the interim workaround is disabling ARP hardware-address rewriting in ebtables SNAT rules.

CVE-2025-39964 (CVSS 7.8 per CNA; NVD splits this as a 5.5 C:N/I:N vector and a separate 7.8 C:H/I:H vector; CWE-362/CWE-366 Race Condition) is a synchronization flaw in the kernel's AF_ALG cryptographic socket interface (crypto/af_alg.c) that allowed two threads to issue concurrent sendmsg() writes to the same socket, interleaving request payloads unpredictably inside the kernel's crypto processing queue and leaving the per-socket context inconsistent. A local, low-privileged user can trigger a kernel crash or cause corrupted cryptographic operation results -- a data-integrity concern for any application relying on AF_ALG for in-kernel crypto. The fix adds an exclusive write-ownership field (ctx->write) so only one writer can hold the socket at a time; interim mitigation is blacklisting the af_alg module.

All three flaws also appear in Siemens ProductCERT advisories (SSA-032379 for CVE-2025-39682; SSA-019113 for CVE-2025-39964) covering industrial and embedded Linux-based products, extending exposure beyond general-purpose servers into OT/ICS environments. No specific threat actor, malware family, or public IOC set has been attributed to the in-the-wild exploitation; CISA's KEV listing is the operative evidence of active exploitation, and Red Hat's advisory language ('known public exploits') indicates public exploit code exists for at least one of the three flaws.

MITRE ATT&CK techniques by tactic:

Inhibit Response Function

T0814 Denial of Service

Lateral Movement

T0866 Exploitation of Remote Services; T1210 Exploitation of Remote Services

Privilege Escalation

T0890 Exploitation for Privilege Escalation; T1068 Exploitation for Privilege Escalation; T1611 Escape to Host

Credential Access

T1040 Network Sniffing; T1212 Exploitation for Credential Access

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Execution

T1106 Native API

Initial Access

T1190 Exploit Public-Facing Application

Stealth

T1211 Exploitation for Stealth

Impact

T1499.004 Application or System Exploitation; T1529 System Shutdown/Reboot; T1565.001 Data Manipulation; T1565.003 Runtime Data Manipulation

Persistence

T1546 Event Triggered Execution

Resource Development

T1587.004 Develop Capabilities; T1588.005 Exploits; T1588.006 Obtain Capabilities

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for Linux kernel KEV flaws

Patches

  • RHSA-2026:36645 (RHEL 9, CVE-2026-53266)
  • RHSA-2026:39082 and RHSA-2026:39083 (RHEL 8, CVE-2026-53266)
  • Upstream kernel fix commits for CVE-2025-39682 (net/tls/tls_sw.c) and CVE-2025-39964 (crypto/af_alg.c), backported via distribution stable-kernel updates

Immediate actions

  • Apply Red Hat kernel updates per RHSA-2026:36645 (RHEL 9) addressing CVE-2026-53266
  • Apply Red Hat kernel updates per RHSA-2026:39082 and RHSA-2026:39083 (RHEL 8) addressing CVE-2026-53266
  • Blacklist the tls kernel module (modprobe -r tls) pending patch deployment for CVE-2025-39682, per Red Hat solution 41278
  • Blacklist the af_alg kernel module (modprobe -r af_alg) pending patch deployment for CVE-2025-39964
  • Disable ARP sender-hardware-address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces, to mitigate CVE-2026-53266

Workarounds

  • Blacklist the tls and af_alg kernel modules on systems where kTLS/AF_ALG are unused
  • Remove or reconfigure ebtables SNAT rules that perform ARP sender-hardware-address rewriting on bridge interfaces

Longer-term hardening

  • Track CISA KEV additions against BOD 26-04 remediation deadlines as part of routine patch governance
  • Conduct forensic triage on FCEB and exposed assets per CISA KEV notes to check for evidence of prior exploitation rather than relying on patching alone
  • Restrict kernel TLS (kTLS) offload configuration to services that genuinely require it, reducing the CVE-2025-39682 remote attack surface
  • Audit bridge netfilter/ebtables SNAT ARP-rewrite configurations across containerized and virtualized Linux fleets, since the ebt_snat.c flaw's Scope:Changed rating implies potential cross-boundary (e.g., container) impact

Affected and fixed versions

  • Linux — Linux Kernel -- kTLS / net/tls receive path
    Vulnerable versions: Upstream kernel versions with CONFIG_TLS software kTLS support predating the tls_sw.c rx_list fix
    Fixed in: Kernel versions incorporating the upstream tls_sw.c fix commits referenced in the NVD record for CVE-2025-39682
  • Linux — Linux Kernel -- netfilter bridge ebtables SNAT (ebt_snat.c)
    Vulnerable versions: Kernel versions containing commit 63137bc5882a, which introduced the unchecked skb_store_bits() ARP SHA rewrite regression
    Fixed in: RHEL 9 via RHSA-2026:36645; RHEL 8 via RHSA-2026:39082 and RHSA-2026:39083; upstream fix commits referenced in the NVD record for CVE-2026-53266
  • Linux — Linux Kernel -- AF_ALG crypto socket interface (crypto/af_alg.c)
    Vulnerable versions: Kernel versions predating the ctx->write exclusive-ownership fix for concurrent sendmsg() writers
    Fixed in: Kernel versions incorporating the upstream af_alg.c fix commits referenced in the NVD record for CVE-2025-39964
  • Red Hat — Red Hat Enterprise Linux 8
    Vulnerable versions: RHEL 8 kernel packages prior to the patched errata
    Fixed in: Per RHSA-2026:39082 and RHSA-2026:39083 (CVE-2026-53266)
  • Red Hat — Red Hat Enterprise Linux 9
    Vulnerable versions: RHEL 9 kernel packages prior to the patched errata
    Fixed in: Per RHSA-2026:36645 (CVE-2026-53266)
  • Siemens — Industrial/embedded products using affected Linux kernel versions (Siemens ProductCERT SSA-032379, SSA-019113)
    Vulnerable versions: Products bundling affected Linux kernel versions per Siemens ProductCERT advisories
    Fixed in: Per Siemens ProductCERT remediation guidance in SSA-032379 (CVE-2025-39682) and SSA-019113 (CVE-2025-39964)

Timeline of Linux kernel KEV flaws

Last updated · 5 updates · revalidated 5× · latest source

Showing the 20 most recent tracked events.

  • locked-ioc-50 CVE announcement bot discloses CVE-2025-39964 (locked-ioc-55 concurrent-write race condition) via the linux-cve-announce mailing list.
  • Siemens publishes SSA-032379 for SIMATIC CN 4100 (firmware before V5.0), a ~159-CVE bundle that includes the fix for CVE-2025-39682.
  • locked-ioc-56 issues Binding Operational Directive 26-04, 'Prioritizing Security Updates Based on Risk,' establishing the risk-tiered patching framework (including a 3-day window for the highest-risk tier) under which these three CVEs were later scoped.
  • locked-ioc-50 CVE announcement bot discloses CVE-2026-53266 (ebtables SNAT ARP sender-hardware-address rewrite out-of-bounds write) via the linux-cve-announce mailing list.
  • Siemens publishes SSA-019113 for the additional GNU/Linux subsystem in specific SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP models, a 240+-CVE bundle that includes CVE-2025-39964.
  • Siemens updates SSA-019113; CVE-2025-39964 remains without an available fix on the affected SIMATIC S7-1500 GNU/Linux subsystem.
  • locked-ioc-53's updated CVE-2025-39964 advisory independently rates the flaw CVSS 3.1 7.3 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H), diverging from both the CNA (7.8) and NVD (5.5) scores.
  • locked-ioc-56's two KEV bulletins are identified individually: a standalone 'Adds One Known Exploited Vulnerability to Catalog' alert for CVE-2025-39682, and a separate 'Adds Two Known Exploited Vulnerabilities to Catalog' alert for CVE-2026-53266 and CVE-2025-39964 -- resolving the catalog-feed-vs-bulletin discrepancy already on record for this threat.
  • locked-ioc-56 publishes a public KEV alert bulletin naming only CVE-2025-39964 and CVE-2026-53266; CVE-2025-39682 carries the same date-added/due-date fields in the KEV data feed but is absent from this specific bulletin post -- a catalog-feed-vs-bulletin discrepancy defenders reconciling BOD 26-04 scope should note.
  • locked-ioc-56 adds CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to the Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04, citing active exploitation.
  • The same reporting cycle notes researcher locked-ioc-48 simultaneously disclosing four unrelated locked-ioc-50 LPE flaws (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, CVE-2026-74469), indicating a broader wave of locked-ioc-50 LPE disclosures that week.
  • locked-ioc-51's vulnerability database lists CVE-2026-53266 as 'Known Exploited: No' with no verified public exploit code, diverging from locked-ioc-56's KEV active-exploitation determination.
  • Secondary press (The Hacker News, Cyber Security News) quotes an updated locked-ioc-53 advisory claiming known public exploits for CVE-2025-39964 and CVE-2026-53266; this research's direct review of locked-ioc-53's own CVE pages could not independently corroborate that statement, so it should be treated as sourced-but-unverified.
  • The Hacker News publishes a report on the locked-ioc-56 KEV addition and locked-ioc-53's confirmation of active exploitation.
  • locked-ioc-53 updates its security advisories for all three CVEs at 02:00 UTC, stating each is 'high risk' with 'known public exploits' leveraging the vulnerabilities.
  • BleepingComputer publishes summary coverage of the locked-ioc-56 KEV alert covering all three locked-ioc-50 flaws.
  • BOD 26-04 remediation deadline for FCEB agencies to patch, mitigate, or discontinue use of affected systems and complete forensic triage.
  • Vulnerability-intelligence platforms (Wiz, Qualys) publish CVE-2025-39964 tracking pages reporting an EPSS exploitation-probability score of 61.2 (percentile), corroborating locked-ioc-56 KEV status and public exploit-code availability.
  • Qualys publishes BOD 26-04 timeline guidance detailing the 3-day (internet-exposed) / 14-day (internal) remediation windows for the three flagged locked-ioc-50 CVEs.
  • Cyber Security News publishes a report titled '14-Year-Old locked-ioc-50 Flaw,' summarizing the CVE-2025-39964 disclosure and KEV addition.

Update history

Sources cited for Linux kernel KEV flaws

Showing 15 of 18 sources, primary sources first.

Drafted by the Threadlinqs research pipeline from 18 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats