CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild
CISA added three actively exploited Linux kernel flaws (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to KEV; federal patch deadline September 21, 2026.
CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on September 19, 2026, citing evidence of active exploitation: CVE-2025-39682 (CVSS 9.8, memory disclosure/DoS in the TLS receive path), CVE-2026-53266 (CVSS 8.8, out-of-bounds write in the ebtables SNAT ARP rewrite path enabling local privilege escalation), and CVE-2025-39964 (CVSS 7.8, race condition in concurrent AF_ALG socket writes causing DoS or data corruption). Red Hat updated its advisories to acknowledge active exploitation, stating known public exploits exist and urging high-priority remediation. Under BOD 26-04, federal civilian agencies must apply fixes by September 21, 2026. Separately, researcher Asim Manizada disclosed four local privilege escalation flaws: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469).
- CISA added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to the KEV catalog citing active exploitation.
- CVE-2025-39682 (CVSS 9.8) enables memory disclosure or DoS via the TLS receive path.
- CVE-2026-53266 (CVSS 8.8) allows local privilege escalation through an out-of-bounds write in ebtables SNAT ARP rewrite.
- Red Hat confirms public exploits; FCEB agencies must patch by September 21, 2026 under BOD 26-04.
- Researcher disclosed four additional local privilege escalation flaws: DirtyAH6, TUNderflow, PPPoEject, and DiagSpill.
- CVEs
- CVE-2025-39682CVE-2026-53266CVE-2025-39964CVE-2026-80844CVE-2026-81000CVE-2026-68121CVE-2026-74469
- Vendors
- Red Hat
- Products
- Linux kernel
- Organizations
- CISAThe Hacker News
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-39682 | Improper Condition Check in Linux Kernel kTLS Receive Path Enables Local Info Leak/DoS | 9.8 | 3% | KEV | KEV |
| CVE-2025-39964 | Race Condition in Linux Kernel Crypto Socket (af_alg_sendmsg) | 5.5 | 2% | KEV | KEV |
| CVE-2026-53266 | Out-of-Bounds Write in Linux Kernel ebtables SNAT ARP Rewrite (netfilter bridge) | 8.8 | <1% | KEV | KEV |
| CVE-2026-68121 | Use-After-Free in Linux Kernel PPPoE Send Path Enables Local Root (PPPoEject) | 7.8 | <1% | PoC ×2 | |
| CVE-2026-74469 | Linux kernel: sctp: prevent peer transport count overflow sctp_assoc_add_peer() increments the association's 16-bit… | 8.8 | <1% | ||
| CVE-2026-80844 | Out-of-bounds memory access in Linux kernel AH6 (xfrm) enables local privilege escalation | — | <1% | PoC ×2 | |
| CVE-2026-81000 | Linux kernel TUN/TAP headroom integer underflow enables local memory corruption | 7.8 | <1% | PoC ×2 |
From the original article
1 min read at thehackernews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.