CISA adds three exploited Linux kernel flaws to KEV catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after finding evidence that they are being exploited in the wild. The entries are CVE-2025-39682, rated 9.8; CVE-2026-53266, rated 8.8; and CVE-2025-39964, rated 7.8.
Under Binding Operational Directive 26-04, Federal Civilian Executive Branch agencies are recommended to apply the necessary fixes by September 21, 2026. CISA’s listing establishes active exploitation, but public details of the techniques being used have not been released.
Three separate Linux kernel attack surfaces
CVE-2025-39682 is an improper check for unusual or exceptional conditions in the kernel TLS receive path. A locally authenticated user could use the flaw to disclose memory or cause a denial of service.
CVE-2026-53266 affects the ebtables Source Network Address Translation Address Resolution Protocol rewrite path. The out-of-bounds write could allow a local attacker to cause unintended system behaviour, a denial of service, or local privilege escalation.
CVE-2025-39964 is a race condition involving concurrent writes to the same AF_ALG socket. The issue can let a local attacker crash a system or corrupt cryptographic operation results, creating denial-of-service and data-integrity risks.
Vendor advisories acknowledge active exploitation
Red Hat updated advisories for all three vulnerabilities on September 19, 2026, at 2 a.m. UTC to acknowledge active exploitation. The company described the CVEs as high risk and said public exploits are known, urging customers to address them with high priority.
The available reporting does not establish whether the vulnerabilities are being weaponized as one attack chain. The three issues also require local access in the described scenarios, which makes control of user access, workload isolation and timely kernel maintenance relevant alongside patch deployment.
CISA’s action follows a broader pattern in which CISA’s KEV catalog of exploited vulnerabilities illustrates how the KEV catalog concentrates attention on vulnerabilities with observed abuse rather than theoretical severity alone. For security teams, the immediate task is to map the affected Linux kernel versions in use, obtain the applicable vendor updates, test them under operational controls and prioritize deployment before the federal remediation deadline.
What organizations should do now
Organizations running Linux should review the vendor advisories applicable to their distributions and verify whether their deployed kernel packages contain fixes for all three CVEs. They should also track systems that cannot be updated promptly and apply their established compensating controls while remediation is scheduled.
The practical business implication is clear: active-exploitation status should move these kernel fixes into an urgent, evidenced vulnerability-management workflow, with ownership and deployment verification recorded across affected estates.