The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three vulnerabilities affecting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence that the flaws are being actively exploited in the wild.
The vulnerabilities affect several Linux kernel components and range in severity from high to critical. Organizations using affected Linux systems are advised to prioritize the available security updates.
Three Linux Kernel Vulnerabilities Added to CISA KEV
The vulnerabilities added to CISA’s KEV catalog are:
CVE-2025-39682 — TLS Receive Path Vulnerability
CVSS score: 9.8
CVE-2025-39682 is an improper-check vulnerability affecting the Linux kernel’s TLS receive path.
A local authenticated attacker could potentially exploit the flaw to trigger memory disclosure or a denial-of-service (DoS) condition.
Given its high severity and the reported evidence of exploitation, organizations should prioritize patching affected systems.
CVE-2026-53266 — ebtables SNAT ARP Rewrite Vulnerability
CVSS score: 8.8
CVE-2026-53266 is an out-of-bounds write vulnerability in the ebtables Source Network Address Translation (SNAT) Address Resolution Protocol (ARP) rewrite path.
Successful exploitation could allow a local attacker to cause unintended system behavior, trigger a denial-of-service condition, or potentially achieve local privilege escalation.
CVE-2025-39964 — AF_ALG Socket Race Condition
CVSS score: 7.8
CVE-2025-39964 is a race condition affecting concurrent writes to the same AF_ALG socket.
An attacker with local access could potentially exploit the flaw to crash the system or corrupt the results of cryptographic operations. This could result in denial of service or data integrity issues.
Details of Active Exploitation Remain Limited
At the time of writing, there are no publicly available details explaining exactly how the three vulnerabilities are being exploited in real-world attacks.
It is also unclear whether the vulnerabilities are being exploited independently or are being combined as part of a larger attack chain.
However, Red Hat updated its security advisories for all three vulnerabilities on September 19, 2026, acknowledging active exploitation.
Red Hat described the risk associated with the vulnerabilities and urged organizations to address them with high priority, noting that public exploits are known to exist.
Federal Agencies Given September 21 Patch Deadline
The addition of the vulnerabilities to CISA’s KEV catalog also brings an important deadline for U.S. federal agencies.
Under Binding Operational Directive (BOD) 26-04, which prioritizes security updates based on risk, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the necessary security fixes by September 21, 2026.
While the directive specifically applies to federal civilian agencies, the reported active exploitation makes these vulnerabilities relevant to organizations running affected Linux kernel versions more broadly.
More Linux Kernel Privilege Escalation Flaws Disclosed
The latest CISA additions come shortly after security researcher Asim Manizada disclosed four additional local privilege escalation vulnerabilities affecting the Linux kernel.
The vulnerabilities are:
- CVE-2026-80844, also known as DirtyAH6
- CVE-2026-81000, also known as TUNderflow
- CVE-2026-68121, also known as PPPoEject
- CVE-2026-74469, also known as DiagSpill
The disclosures highlight the continued security challenges surrounding the Linux kernel, particularly vulnerabilities that can be exploited by attackers who already have local access to a system.
What Organizations Should Do
Administrators should review their Linux environments for affected kernel versions and apply vendor-provided security updates as soon as practical.
Organizations should also monitor security advisories from their Linux distribution vendors and review relevant systems for signs of exploitation, particularly where vulnerable kernel components are exposed to untrusted or low-privileged users.
With CISA now listing all three vulnerabilities in its KEV catalog and vendors acknowledging active exploitation, organizations should treat the affected vulnerabilities as a high-priority patching concern.
