CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two actively exploited Linux kernel flaws, CVE-2025-39964 (race condition) and CVE-2026-53266 (out-of-bounds write), to its KEV Catalog.
CISA added CVE-2025-39964, a Linux kernel race condition vulnerability, and CVE-2026-53266, a Linux kernel out-of-bounds write vulnerability, to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control post-exploitation, and must check whether systems were compromised before patches were applied. All organizations are encouraged to prioritize KEV remediation.
- Two Linux kernel vulnerabilities added to the KEV Catalog: CVE-2025-39964 and CVE-2026-53266
- Both were added based on evidence of active exploitation
- BOD 26-04 requires FCEB agencies to prioritize KEV remediation on exposed assets
- Agencies must check for compromise occurring before the patch was applied
- Vendors
- CISA
- Products
- Linux Kernel
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-39964 | Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg) | 5.5 | 2% | KEV | KEV |
| CVE-2026-53266 | Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge) | 8.8 | <1% | KEV | KEV |
From the original article
1 min read at cisa.govCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2025-39964 Linux Kernel Race Condition Vulnerability CVE-2026-53266 Linux Kernel Out-of-Bounds Write Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.