CISA Warns of Three Actively Exploited Linux Kernel Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added several Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. This is the federal government’s official list of security flaws that attackers are actively using. Three of these bugs were linked to a real-world exploit chain used to break into a locked Android smartphone. They affect the core of an operating system that runs on billions of devices, from servers and cloud infrastructure to the phone in your pocket.

Here’s what happened, why it matters, and what you should do now.

The Three Vulnerabilities at a Glance

All three flaws involve how the Linux kernel handles USB devices: webcams, audio devices, and input devices like keyboards. That detail is central to how they were exploited.

CVE-2024-53104: UVC Driver Out-of-Bounds Write

This flaw sits in the kernel function that parses video frame formats from USB cameras. A specially crafted USB device can trigger an out-of-bounds write. That can let an attacker with physical access escalate privileges on the device. Google patched it in the February 2025 Android Security Bulletin and noted that it “may be under limited, targeted exploitation.”

CVE-2024-53197: ALSA USB-Audio Out-of-Bounds Access

This bug lives in the Advanced Linux Sound Architecture (ALSA) driver for certain USB audio devices. A malicious USB device can report invalid configuration values. The kernel then accesses memory outside allocated boundaries.

CVE-2024-50302: HID Core Memory Leak

This flaw fails to properly initialize a report buffer in the HID subsystem. Malicious input devices can then leak kernel memory. On its own, this is a medium-severity issue. In an exploit chain, however, leaked memory helps attackers bypass security protections and make the other bugs reliably exploitable.

How the Vulnerabilities Were Exploited

The exploitation came to light through Amnesty International’s Security Lab. Its researchers investigated the Android phone of a student activist in Serbia in early 2025.

According to Amnesty, the device had been unlocked using a zero-day exploit chain attributed to Cellebrite. Cellebrite is an Israeli company that sells mobile forensic tools to law enforcement agencies worldwide. The attack chain reportedly worked like this:

1. Physical access: authorities obtained the target’s locked phone.
2. Emulated USB devices: a specialized device posed as malicious USB peripherals, such as a webcam, audio device, and keyboard.
3. Kernel exploitation: the fake peripherals triggered the three kernel flaws, which corrupted memory, leaked data, and escalated privileges.
4. Device unlock: the chain bypassed the lock screen, giving full access to the phone’s data.

Amnesty shared its findings with Google. Google’s Threat Analysis Group helped identify the vulnerabilities, and patches followed across Android’s monthly security bulletins.

Why this matters: Exploits developed for “lawful” forensic tools can be misused against journalists, activists, and civil society. Once a vulnerability is known to be exploited, it can also spread to other threat actors.

What CISA’s KEV Listing Means

When CISA adds a flaw to the KEV catalog, it is not a suggestion. Under Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies must remediate listed vulnerabilities by a set deadline, typically three weeks.

The directive only binds federal agencies. CISA still strongly urges every organization, from state and local governments to private companies, to prioritize KEV vulnerabilities. The catalog is widely used as a practical patching priority list because it reflects real-world attacks, not just theoretical risk.

Who Is at Risk?

• Android users: Android runs on the Linux kernel. Unpatched phones, especially older models no longer receiving updates, are the most exposed.
• Linux desktops and laptops: systems with exposed USB ports running outdated kernels.
• Embedded and IoT devices: routers, kiosks, industrial systems, and appliances often run old kernels and rarely get updates.
• Enterprise and government endpoints: any device that could be physically seized, stolen, or left unattended.

The attack requires physical access, so the typical home user faces a lower risk than a high-value target. The most exposed groups are journalists, activists, lawyers, executives, government employees, and anyone crossing borders with sensitive data.

How to Protect Yourself and Your Organization

For Android Users

1. Update now. Go to Settings → System → Software update and install the latest security patch. Look for a patch level of April 2025 or later.
2. Check Google Play system updates under Settings → Security & privacy.
3. Replace unsupported devices. If your phone no longer gets security updates, it will stay vulnerable.
4. Restart regularly. A recently rebooted phone, in its “Before First Unlock” state, is generally harder to extract data from.
5. Use a strong alphanumeric passcode instead of a short PIN or pattern.

For Linux Administrators

1. Update kernels to the latest stable or long-term support (LTS) versions from your distribution (Ubuntu, Debian, Red Hat, SUSE, etc.).
2. Check vendor advisories for backported fixes tied to each CVE.
3. Restrict USB access on sensitive systems. Tools like USBGuard can whitelist only approved devices.
4. Disable unneeded kernel modules such as uvcvideo or snd-usb-audio on servers that don’t need them.
5. Monitor the CISA KEV catalog and add it to your vulnerability management workflow.

For Security Teams

• Prioritize KEV entries over CVSS scores alone. A “medium” flaw like CVE-2024-50302 can be critical inside an exploit chain.
• Inventory embedded and IoT devices running Linux, which are often forgotten in patch cycles.
• Train high-risk staff on device seizure and physical security risks.

The Bigger Picture

This case highlights three trends in cybersecurity:

• The Linux kernel is a high-value target. It powers most of the world’s servers, the cloud, and more than 3 billion Android devices, so a single kernel bug can have massive reach.
• USB remains a major attack surface. Decades-old drivers for webcams, audio cards, and input devices hold bugs that attackers can trigger simply by plugging something in.
• Commercial forensic and spyware tools are a growing concern. CISA’s listing of flaws exploited by a commercial forensic vendor shows that these tools pose real risks to civil liberties and security.

Frequently Asked Questions

Are these vulnerabilities exploitable remotely? No. The documented attacks required physical access to the device through its USB port.

Is my iPhone affected? No. These flaws affect the Linux kernel, which iPhones do not use. Apple devices have faced their own forensic-exploitation issues, so keep them updated too.

How do I know if my Android phone is patched? Check Settings → About phone → Android version → Android security update. A date of April 2025 or later covers all three flaws.

Does CISA’s directive apply to private businesses? Not legally, but CISA strongly recommends that all organizations treat KEV vulnerabilities as a top patching priority.

Bottom Line

CISA’s warning is a clear signal: these Linux kernel vulnerabilities are being used in real attacks, not just studied in labs. Update your Android devices, patch your Linux systems, and restrict USB access wherever possible. In cybersecurity, known exploited vulnerabilities are the ones attackers count on you to ignore.

Sources

1. CISA – Known Exploited Vulnerabilities Catalog: cisa.gov/known-exploited-vulnerabilities-catalog
2. CISA – Binding Operational Directive 22-01: cisa.gov/news-events/directives/bod-22-01
3. NIST National Vulnerability Database:
   • nvd.nist.gov/vuln/detail/CVE-2024-53104
   • nvd.nist.gov/vuln/detail/CVE-2024-53197
   • nvd.nist.gov/vuln/detail/CVE-2024-50302
4. Google – Android Security Bulletins (February, March, April 2025): source.android.com/docs/security/bulletin
5. Amnesty International Security Lab: report on the Cellebrite zero-day exploit used against a Serbian student activist (February 2025), amnesty.org
6. Linux Kernel CVE Announcements: lore.kernel.org/linux-cve-announce