CISA Issues Emergency Directive on Actively Exploited Linux Kernel Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. The flaws tracked as CVE-2024-1084, CVE-2024-1085, and CVE-2024-1086 affect the Linux kernel, with one assigned a critical severity rating. According to the CISA alert, these vulnerabilities are being actively exploited by threat actors, prompting the agency to issue an emergency directive requiring federal civilian executive branch agencies to patch affected systems. The directive mandates that covered agencies apply mitigating updates or employ compensating controls within a specified remediation window. While technical details on the attack vectors were initially limited, the exploitation status has been confirmed as active. The vulnerabilities impact the Linux kernel across multiple distributions, and patches are expected to be released or have been released by distribution maintainers. CISA recommends that all organizations using affected kernel versions apply updates promptly and monitor for signs of compromise. The alert underscores the importance of timely patching of kernel-level flaws, which can provide attackers with elevated privileges or remote code execution capabilities if exploited successfully.