CISA KEV Alert: CVE-2025-39964 and CVE-2026-53266 Linux Kernel Exploits — Detection and Remediation Guide

---
title: Suspicious Execution From World-Writable Directory on Linux
title_note: Potential kernel LPE exploit staging (CVE-2025-39964 / CVE-2026-53266)
id: 9c1e4a77-2b3d-4f58-a912-7e6d5c8b3a01
status: experimental
description: Detects execution of binaries from world-writable or temporary directories commonly used to stage local privilege escalation exploits against the Linux kernel, such as those exploiting CVE-2025-39964 or CVE-2026-53266.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/09/19
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_path:
    Image|startswith:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/run/shm/'
  filter_service_binaries:
    Image|startswith:
      - '/tmp/snap'
      - '/tmp/hsperfdata'
  condition: selection_path and not filter_service_binaries
falsepositives:
  - Legitimate installer or build tooling staging in /tmp during maintenance windows
  - DevOps automation (Ansible, Terraform provisioners) executing temporary scripts
level: high
---
title: Unprivileged User Spawning Root Shell on Linux
id: 4d8f2b16-7c9a-4e31-b805-2f7a9d6e1c44
status: experimental
description: Detects an interactive shell or interpreter spawned with elevated privileges, consistent with successful kernel privilege escalation via exploits such as CVE-2025-39964 (race condition) or CVE-2026-53266 (out-of-bounds write).
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/09/19
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_shell:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/dash'
  selection_root:
    User:
      - 'root'
      - 'uid=0'
  filter_parents:
    ParentImage|endswith:
      - '/sshd'
      - '/sudo'
      - '/su'
      - '/login'
      - '/systemd'
  condition: selection_shell and selection_root and not filter_parents
falsepositives:
  - Administrative scripts executed via cron or systemd units running as root
  - Configuration management agents (Chef, Puppet) spawning shells as root
level: critical
---
title: Kernel Exploit Artifact Compilation on Linux Host
id: 6b2c8e93-1d47-4a6f-9023-8e5b3d7c2f19
status: experimental
description: Detects on-host compilation of C source code by non-build users, a common pattern when attackers compile kernel privilege escalation exploits (e.g., CVE-2025-39964 or CVE-2026-53266 PoCs) directly on the target to match the running kernel.
references:
  - https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog
  - https://attack.mitre.org/techniques/T1027/007/
author: Security Arsenal
date: 2026/09/19
tags:
  - attack.privilege_escalation
  - attack.t1068
  - attack.defense_evasion
logsource:
  category: process_creation
  product: linux
detection:
  selection_compilers:
    Image|endswith:
      - '/gcc'
      - '/cc'
      - '/clang'
      - '/g++'
  selection_args:
    CommandLine|contains:
      - ' -o /tmp/'
      - ' -o /dev/shm/'
      - '.c '
      - '-lpthread'
  filter_build_dirs:
    CommandLine|contains:
      - '/usr/src/'
      - '/opt/build'
      - 'make'
  condition: selection_compilers and selection_args and not filter_build_dirs
falsepositives:
  - Developers or build pipelines compiling on production hosts (should be prohibited by policy)
level: high

// Hunt 1: Execution from world-writable paths on Linux hosts (LPE exploit staging)
// Relevant to CVE-2025-39964 / CVE-2026-53266 post-foothold exploitation
Syslog
| where TimeGenerated > ago(7d)
| where Facility in ("auth", "authpriv", "user", "audit") or SyslogMessage has_any ("execve", "EXECVE")
| where SyslogMessage has_any ("/tmp/", "/var/tmp/", "/dev/shm/", "/run/shm/")
| where SyslogMessage !has_any ("snap", "hsperfdata", "systemd", "ansible")
| extend HostName = tostring(HostName), Message = tostring(SyslogMessage)
| summarize ExecutionCount = count(), DistinctProcesses = dcount(ProcessName) by HostName, ProcessName, Message, bin(TimeGenerated, 1h)
| order by TimeGenerated desc;

// Hunt 2: Sudden root shell activity correlating with non-root parent processes
// Detects privilege transition consistent with successful kernel LPE
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("uid=0", "euid=0", "session opened for user root")
| where SyslogMessage !has_any ("sudo:", "su:", "sshd", "cron", "CRON", "systemd")
| summarize RootEvents = count(), Samples = make_list(SyslogMessage, 5) by HostName, bin(TimeGenerated, 1h)
| order by TimeGenerated desc;

// Hunt 3: Kernel error/anomaly messages — potential exploit crash artifacts or OOPS
// Race condition and OOB write attempts frequently leave kernel log noise before success
Syslog
| where TimeGenerated > ago(7d)
| where Facility == "kern"
| where SyslogMessage has_any ("BUG:", "Oops", "general protection fault", "kernel panic", "KASAN", "out-of-bounds", "use-after-free", "unable to handle kernel")
| summarize KernelAnomalies = count(), Samples = make_list(SyslogMessage, 3) by HostName, SeverityLevel, bin(TimeGenerated, 1h)
| order by KernelAnomalies desc;

// Hunt 4: Defender for Endpoint — process execution from writable dirs on Linux devices
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("/tmp/", "/var/tmp/", "/dev/shm/", "/run/shm/")
| where InitiatingProcessAccountName !in ("root", "system")
| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
| order by LastSeen desc;

-- Hunt for LPE exploit staging and execution artifacts on Linux endpoints
-- Targets CVE-2025-39964 / CVE-2026-53266 post-exploitation behavior

-- 1. Recently created executables in world-writable directories
SELECT FullPath, Size, Mtime, Ctime, Mode.String AS Permissions
FROM glob(globs=['/tmp/**', '/var/tmp/**', '/dev/shm/**', '/run/shm/**'])
WHERE NOT IsDir
  AND Mode.String =~ 'x'
  AND Mtime > now() - 604800
ORDER BY Mtime DESC

-- 2. Processes running from suspicious paths or with mismatched privilege context
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Exe =~ '^/(tmp|var/tmp|dev/shm|run/shm)/'
   OR CommandLine =~ '(/tmp/|/dev/shm/)[a-zA-Z0-9_.-]+'

-- 3. Audit kernel log artifacts indicative of exploitation attempts
SELECT FullPath, Size, Mtime
FROM glob(globs=['/var/log/kern.log*', '/var/log/messages*', '/var/log/audit/audit.log*'])
WHERE Mtime > now() - 604800

#!/usr/bin/env bash
# kernel-kev-audit.sh — Audit and remediate Linux kernel patch status
# Covers CISA KEV additions CVE-2025-39964 and CVE-2026-53266 (KEV date: 2026-09-18)
# Usage: sudo ./kernel-kev-audit.sh [--apply]
set -euo pipefail

APPLY=false
[[ "${1:-}" == "--apply" ]] && APPLY=true

echo "=== CISA KEV Kernel Audit: CVE-2025-39964 / CVE-2026-53266 ==="
echo "Host: $(hostname) | Date: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
echo
echo "[*] Running kernel: $(uname -r)"
echo "[*] Architecture:   $(uname -m)"

# --- Identify distribution ---
if [[ -f /etc/os-release ]]; then
  . /etc/os-release
  DISTRO="${ID}"
  echo "[*] Distribution:   ${PRETTY_NAME}"
else
  echo "[!] Cannot identify distribution. Manual review required."
  exit 1
fi

# --- Distribution-specific patch check ---
case "${DISTRO}" in
  ubuntu|debian)
    echo "[*] Checking for pending kernel security updates..."
    apt-get update -qq 2>/dev/null || true
    apt list --upgradable 2>/dev/null | grep -iE 'linux-image|linux-generic|linux-headers' || \
      echo "[+] No kernel updates pending (verify against vendor tracker for CVE status)."
    echo "[*] Ubuntu security status (if ubuntu-advantage-tools present):"
    command -v pro >/dev/null 2>&1 && pro security-status --esm-infra 2>/dev/null || true
    if [[ "${APPLY}" == true ]]; then
      echo "[*] Applying kernel updates..."
      DEBIAN_FRONTEND=noninteractive apt-get install --only-upgrade -y \
        linux-image-generic linux-headers-generic 2>/dev/null || \
      DEBIAN_FRONTEND=noninteractive apt-get dist-upgrade -y
      echo "[!] REBOOT REQUIRED to load patched kernel."
    fi
    ;;
  rhel|centos|rocky|almalinux|fedora|amzn)
    echo "[*] Checking for pending kernel security updates..."
    yum updateinfo list security 2>/dev/null | grep -i kernel || \
      echo "[+] No kernel security advisories pending (verify against vendor tracker)."
    if [[ "${APPLY}" == true ]]; then
      echo "[*] Applying kernel updates..."
      yum update -y kernel kernel-core kernel-modules || dnf update -y kernel
      echo "[!] REBOOT REQUIRED to load patched kernel."
    fi
    ;;
  sles|opensuse*)
    echo "[*] Checking patches via zypper..."
    zypper list-patches --category security 2>/dev/null | grep -i kernel || \
      echo "[+] No kernel security patches pending."
    [[ "${APPLY}" == true ]] && zypper patch --category security -y && echo "[!] REBOOT REQUIRED."
    ;;
  *)
    echo "[!] Unsupported distro '${DISTRO}'. Verify kernel build date against vendor advisory manually."
    ;;
esac

echo
echo "=== Exposure Indicators (manual review) ==="
echo "[*] Containers sharing this kernel:"
command -v docker >/dev/null 2>&1 && docker ps --format '{{.Names}} ({{.Image}})' | head -20 || echo "    (docker not present)"
command -v kubectl >/dev/null 2>&1 && kubectl get pods -A --no-headers 2>/dev/null | wc -l | xargs echo "    k8s pods on node:" || true

echo "[*] Recent suspicious executions from writable paths (last 7 days, audit log):"
if [[ -f /var/log/audit/audit.log ]]; then
  grep -a 'type=EXECVE' /var/log/audit/audit.log 2>/dev/null | \
    grep -aE '/tmp/|/dev/shm/|/var/tmp/' | tail -20 || echo "    none found"
else
  echo "    (auditd not logging EXECVE — enable audit rules: -a always,exit -F arch=b64 -S execve -F dir=/tmp)"
fi

echo "[*] Recent kernel anomalies:"
(journalctl -k --since "7 days ago" 2>/dev/null || dmesg 2>/dev/null) | \
  grep -iE 'BUG:|Oops|general protection fault|out-of-bounds|KASAN' | tail -10 || echo "    none found"

echo
echo "[*] NOTE: Kernel updates are not active until reboot. Confirm post-reboot with: uname -r"
echo "[*] KEV reference: https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
echo "[*] Alert: https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog"