CISA Adds Two Known Exploited Vulnerabilities to Catalog

CVE-2025-39964 is a race condition (CWE-362) in the Linux kernel's AF_ALG crypto socket interface: the af_alg_sendmsg function did not prevent concurrent writes to the same socket, so two simultaneous writes could interleave data unpredictably and leave the kernel's internal socket state inconsistent. It is triggered by a local user (or local process) issuing concurrent write/sendmsg operations on the same AF_ALG socket, which is why the CVSS v3.1 score is low (3.3, local vector, low availability impact). An attacker exploiting the race primarily gains the ability to corrupt socket state, with potential for degraded availability; confidentiality and integrity are not rated as impacted. Any Linux kernel deployment whose build includes the vulnerable af_alg code is affected, though exploitation requires the ability to run local code that uses the crypto socket API. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation in the wild per CISA, but no public proof-of-concept is known and ransomware use is unknown; EPSS estimates a 0.3% probability of exploitation in the next 30 days.

Do: Apply a kernel update from your distribution or vendor that includes the upstream fix 'crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg'; CISA KEV requires mitigating per BOD 26-04 guidance, so prioritize internet-exposed and multi-user systems. Because the vector is local, reduce exposure by limiting untrusted local code execution and auditing hosts that expose crypto-socket workloads; verify the fix by confirming your running kernel includes the af_alg_sendmsg exclusive-ownership patch.

CVE-2026-53266 is an out-of-bounds write (CWE-787) in the Linux kernel's netfilter bridge ebtables SNAT target: when the optional ARP sender-hardware-address rewrite is active, the kernel writes the new MAC address via skb_store_bits() without first making that byte range writable. If the ARP sender hardware address bytes sit in a nonlinear skb fragment backed by a splice-imported file page, the write maps the fragment page and copies the MAC directly into a file-backed page-cache page, corrupting kernel-managed memory. A local, low-privileged attacker (for example a container tenant, VM, or user able to send traffic into a bridge using ebtables SNAT with ARP rewriting) can trigger this with crafted ARP packets, gaining kernel memory corruption usable for privilege escalation or integrity/availability impact (CVSS 3.1 8.8, scope changed). Any Linux system running a kernel with the vulnerable ebtables SNAT code in a bridged-networking configuration that performs this ARP rewrite is affected; the source data does not state specific affected version ranges. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-09-18, indicating known exploitation, although EPSS is low (0.1%, 2nd percentile) and no public proof-of-concept is known.

Do: Update the kernel via your vendor's stable/security channel to a build that includes the upstream fix 'netfilter: bridge: make ebt_snat ARP rewrite writable', prioritizing internet-exposed and multi-tenant hosts in line with CISA BOD 26-04. Audit bridges, routers, gateways and virtualization hosts for ebtables SNAT rules that rewrite ARP sender hardware addresses and remove or disable those rules as an interim mitigation where patching is not yet possible. Restrict untrusted local/guest access to systems using ebtables bridging until patched.