CISA Adds Three Exploited Linux Kernel Flaws to KEV

CISA added three actively exploited Linux kernel flaws to its Known Exploited Vulnerabilities catalog on September 18, 2026. Federal agencies have until September 21 to apply mitigations under BOD 26-04. Non-federal operators aren’t bound by that directive, but confirmed active exploitation is reason enough to treat the date as a real target.

CVE-2025-39682 (CVSS 9.8, critical) is in the Linux kernel’s TLS receive path. An improper check allows a zero-length record from the rx_list to bypass recvmsg() record-type handling, so subsequent TLS records get processed under incorrect zero-copy and queuing assumptions. NVD notes that affected versions may include end-of-life kernel releases.

CVE-2026-53266 (CVSS 8.8, high) is an out-of-bounds write in the ebtables SNAT target. An ARP sender hardware address rewrite can write into a nonlinear socket-buffer fragment backed by a splice-imported file page. Red Hat rated it “high risk” and confirmed public exploits are already circulating, with documented outcomes including denial of service and local privilege escalation.

CVE-2025-39964 (CVSS 7.8, high) is a race condition in AF_ALG socket operations. Concurrent writes to the same socket cause data to interleave unpredictably and leave internal socket state inconsistent, which can crash the system or corrupt cryptographic results.

What to patch

Red Hat updated advisories for all three are out now. For other distributions, check your vendor’s security channel for patches targeting these CVE IDs. The CVE pages above link to NVD records for version specifics.

NVD flags both CVE-2025-series entries (CVE-2025-39682 and CVE-2025-39964) as potentially affecting end-of-life kernel releases. If you’re on an unsupported kernel, the remediation path is an upgrade, not a patch.

Patch order: CVE-2025-39682 first, CVSS 9.8, TLS receive path. CVE-2026-53266 second, especially on systems running ebtables for bridging or container networking where Red Hat-confirmed public exploits are already in the wild. CVE-2025-39964 third, still confirmed exploited, relevant wherever workloads call AF_ALG directly.

CISA’s September 13 batch covered RouterOS and ScreenConnect with active exploitation confirmed on both. The September 12 round covered Cisco, Citrix, and Fortinet. Earlier Linux kernel CVE context is in the August enterprise kernel analysis.