CVE-2025-39682

CVE: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability: Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
CWE: CWE-754
Published: Linux | Kernel
Link: https://www.cve.org/CVERecord?id=CVE-2025-39682

Threat Analysis (Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability: Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.)

  1. Impact: The flaw can cause TLS decryption or processing errors, potentially exposing data (confidentiality), altering payloads (integrity), or leading to service failures (availability).

  2. Affected Components & Attack Surface: Linux kernel TLS receive path (recvmsg/zero‑copy), rx_list handling, end‑of‑service kernel version.

  3. Exploitation Prerequisites: Network access to send a malformed TLS packet containing a zero‑length record in rx_list; no elevated privileges required.

  4. Detection Ideas & Indicators: Kernel debug logs for recvmsg failures, ATT&CK T1190, CVE‑2025‑39682 ID, logs of unexpected TLS record processing.

  5. Mitigations & Workarounds: Upgrade to patched kernel, disable zero‑copy TLS if supported, or discontinue the EoS product.

  6. Verification Steps: Load patched kernel, transmit crafted packet, confirm recvmsg returns correct record length and no zero‑copy processing errors.

  7. Attack-Path Sequence:

    sequenceDiagram
 Client->>Server: Send TLS record with zero‑length rx_list entry
 Server->>Kernel: recvmsg() receives malformed record
 Kernel->>Kernel: Bypass zero‑length check, process via zero‑copy
 Kernel->>Server: Incorrect TLS record handling
 Server->>Client: Fails or corrupts data

CVE-2026-53266

CVE: Linux Kernel Out-of-Bounds Write Vulnerability: Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
CWE: CWE-787
Published: Linux | Kernel
Link: https://www.cve.org/CVERecord?id=CVE-2026-53266

Threat Analysis (Linux Kernel Out-of-Bounds Write Vulnerability: Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.)

  1. Impact: The out‑of‑bounds write can corrupt kernel memory, potentially causing a kernel panic or denial‑of‑service, thereby compromising Availability and Integrity. Confidentiality is not directly at risk.

  2. Affected Components & Attack Surface: Linux kernel ebtables SNAT target, kernel source version containing the vulnerability. Attack surface is network‑based (remote ARP).

  3. Exploitation Prerequisites: Ability to send malformed ARP packets to the host, vulnerable kernel version (no authentication required), remote network access.

  4. Detection Ideas & Indicators: Kernel log entries (e.g., /var/log/kern.log), ATT&CK T1190, repeated ARP requests with atypical source MAC addresses, elevated syscall counters.

  5. Mitigations & Workarounds: Upgrade to a patched kernel or disable ebtables SNAT targets; apply upstream fix; fallback to a supported kernel version.

  6. Verification Steps: Deploy a test VM with the vulnerable kernel, apply the CVE patch, and attempt the exploit; confirm the system remains stable and no crash occurs.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>Host: Send malformed ARP packet
 Host->>Kernel: Process SNAT target, write to non‑linear buffer
 Kernel->>Kernel: Out‑of‑bounds write corrupts memory
 Kernel->>Host: Kernel panic / OOM
 Host-->>Attacker: Denial of service / crash

CVE-2025-39964

CVE: Linux Kernel Race Condition Vulnerability: Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket’s internal state.
CWE: CWE-362
Published: Linux | Kernel
Link: https://www.cve.org/CVERecord?id=CVE-2025-39964

Threat Analysis (Linux Kernel Race Condition Vulnerability: Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket’s internal state.)

  1. Impact: The race condition can corrupt the internal state of the AF_ALG socket, leading to unpredictable data interleaving. This primarily compromises integrity (incorrect data may be processed) and may cause availability if the socket fails to deliver expected protocol responses.

  2. Affected Components & Attack Surface: Linux kernel (AF_ALG subsystem) – present in kernel versions 6.5+. Attack surface is remote via the network‑accessible AF_ALG socket; no local code changes required.

  3. Exploitation Prerequisites: Ability to open and write to an AF_ALG socket (e.g., through a network application). Two concurrent writes to the same socket from the same or different processes are sufficient; no elevated privileges are needed.

  4. Detection Ideas & Indicators: Kernel tracepoints or dmesg entries for AF_ALG race handling, repeated high‑frequency socket‑write events, ATT&CK T1103 (Process Injection) as a proxy for abnormal socket usage. Look for “AF_ALG race” messages in logs.

  5. Mitigations & Workarounds: Apply the official kernel patch (CVE‑2025‑39964). If patching is not possible, disable the AF_ALG socket or enforce single‑writer policies via application code.

  6. Verification Steps: Use a test harness that spawns two processes writing to the same AF_ALG socket simultaneously; verify that the socket’s internal state remains consistent and that no interleaved data occurs. Re‑run after patch to confirm the race no longer triggers.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>Kernel: Open AF_ALG socket
 NormalApp->>Kernel: Write data
 Attacker->>Kernel: Write data (concurrently)
 Kernel->>Kernel: Race condition detected
 Kernel->>Kernel: Corrupt internal state
 NormalApp->>Kernel: Receive corrupted data

CVE-2026-87886

CVE: Acronis Backup Incorrect Default Permissions Vulnerability: Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.
CWE: CWE-276
Published: Acronis | Backup
Link: https://www.cve.org/CVERecord?id=CVE-2026-87886

Threat Analysis (Acronis Backup Incorrect Default Permissions Vulnerability: Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation.)

  1. Impact: Privilege escalation via the Acronis Backup plugin can compromise the confidentiality of backup data, alter the integrity of system configurations, and disrupt the availability of the backup service.

  2. Affected Components & Attack Surface: The vulnerability resides in the Acronis Backup plugin for cPanel/WHM and the Plesk extension. The attack surface is the web interface of these servers, exposed to remote users.

  3. Exploitation Prerequisites: An attacker with basic web‑access to the cPanel/WHM or Plesk server can upload or modify the plugin without additional privileges; default settings do not require credential theft.

  4. Detection Ideas & Indicators: Search web‑server logs for permission‑change events on the plugin files, look for ATT&CK T1086 (Web Interface) activity, and monitor for unexpected plugin version updates.

  5. Mitigations & Workarounds: Apply the latest Acronis patch, enforce least‑privilege file permissions, disable the default configuration, and use a centralized secure‑configuration management system.

  6. Verification Steps: Verify the plugin’s file permissions (should be 644/755), test the cPanel/WHM/Plesk menu to confirm it does not elevate privileges, and compare the current version against the vendor release.

  7. Attack‑Path Sequence

    sequenceDiagram
 participant Attacker
 participant WebServer
 participant Plugin
 Attacker->>WebServer: Access web interface
 WebServer->>Plugin: Execute plugin permission change
 Plugin->>WebServer: Update default ACLs
 WebServer->>Attacker: Privilege escalation granted

CVE-2026-76460

CVE: Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability: Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.
CWE: CWE-648
Published: Cisco | Identity Services Engine
Link: https://www.cve.org/CVERecord?id=CVE-2026-76460

Threat Analysis (Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability: Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.)

  1. Impact: Unauthorized remote access can compromise device confidentiality (data exposure), integrity (configuration tampering), and availability (service disruption) of Cisco Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE‑PIC).

  2. Affected Components & Attack Surface: The vulnerability resides in the ISE management APIs and the ISE‑PIC web‑based interface, exposing the device to remote exploitation via the public management portal.

  3. Exploitation Prerequisites: An unauthenticated remote attacker must be able to reach the ISE web UI and trigger the privileged API bypass; no special credentials or host‑based configuration are required beyond network reachability.

  4. Detection Ideas & Indicators: Look for anomalous unauthenticated login attempts, missing audit entries for privileged API calls, error logs indicating API misuse, and CVE‑2026‑76460 references in security event streams.

  5. Mitigations & Workarounds: Deploy the latest Cisco security patch, disable or restrict privileged API usage, enforce strong authentication for the web UI, and segment the ISE network from the internet.

  6. Verification Steps: Run a vulnerability scanner (e.g., Nessus) against the ISE to detect the CVE; alternatively, manually invoke the privileged API without authentication and confirm successful unauthorized operation.

  7. Attack‑Path Sequence:

    sequenceDiagram
 Attacker->>ISE: Remote unauthenticated request to privileged API
 ISE->>ISE: Bypass web‑UI authentication
 ISE->>Device: Execute privileged operation
 Device->>ISE: Return successful response
 ISE->>Attacker: Grant remote access to device