U.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog
CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266) to its KEV catalog, federal patch deadline September 21, 2026.
CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-39682 (CVSS 9.8), a TLS receive path flaw allowing authenticated local users to expose sensitive memory or cause denial-of-service; CVE-2026-53266 (CVSS 8.8), an out-of-bounds write in the ebtables SNAT ARP rewrite path enabling crashes or privilege escalation; and CVE-2025-39964 (CVSS 7.8), a race condition in AF_ALG sockets affecting system stability and cryptographic integrity. Details on how the flaws are exploited in the wild or whether they form a single attack chain are not yet available. Under BOD 22-01, federal civilian agencies must remediate the flaws by September 21, 2026, and private organizations are urged to patch as well.
- CVE-2025-39682 (CVSS 9.8): TLS receive path flaw can leak sensitive memory or cause DoS.
- CVE-2026-53266 (CVSS 8.8): Out-of-bounds write in ebtables ARP path enables local privilege escalation.
- CVE-2025-39964 (CVSS 7.8): AF_ALG socket race condition can crash systems or corrupt crypto operations.
- KEV listing mandates federal agencies patch by September 21, 2026 under BOD 22-01.
- Vendors
- Linux KernelCISA
- Products
- Linux Kernel
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-39682 | Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoS | 9.8 | 3% | KEV | KEV |
| CVE-2025-39964 | Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg) | 5.5 | 2% | KEV | KEV |
| CVE-2026-53266 | Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge) | 8.8 | <1% | KEV | KEV |
From the original article
1 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.