CISA Warns of Linux Kernel Vulnerabilities Actively Exploited in Attacks
CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV with a September 21 federal patching deadline.
CISA added CVE-2025-39682 (CVSS 9.8, improper condition check in the kernel TLS receive path affecting kTLS-enabled TCP sockets), CVE-2026-53266 (CVSS 8.8, out-of-bounds write in netfilter bridge ebtables SNAT), and CVE-2025-39964 (CVSS 7.8, race condition in AF_ALG) to its Known Exploited Vulnerabilities catalog on September 18, 2026. Binding Operational Directive 26-04 requires federal civilian agencies to remediate by September 21 and perform forensic triage for evidence of compromise. The most severe flaw is remotely triggerable on internet-accessible services using kTLS, while the other two require local access and can enable denial of service or privilege escalation. CISA has not attributed the exploitation or identified attackers or victims, but KEV inclusion confirms real-world exploitation.
- CVE-2025-39682: critical kTLS receive-path flaw allowing zero-length records to bypass recvmsg() type handling
- CVE-2026-53266: out-of-bounds write in ebtables SNAT ARP rewriting enabling memory corruption and privilege escalation
- CVE-2025-39964: AF_ALG race condition letting concurrent sendmsg() writes corrupt crypto socket state
- BOD 26-04 mandates patching by September 21 plus forensic triage of potentially exposed federal systems
- Mitigations include disabling kTLS, removing ARP-rewriting SNAT rules, restricting CAP_NET_ADMIN, and blocking af_alg
- Vendors
- Red Hat
- Products
- Linux kernel
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-39682 | Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoS | 9.8 | 3% | KEV | KEV |
| CVE-2025-39964 | Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg) | 5.5 | 2% | KEV | KEV |
| CVE-2026-53266 | Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge) | 8.8 | <1% | KEV | KEV |
From the original article
3 min read at cybersecuritynews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting three Linux kernel vulnerabilities, creating an urgent patching and investigation deadline.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.