CISA Adds Three Actively Exploited Linux Kernel Vulnerabilities to KEV

Three Linux kernel vulnerabilities—CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964—have been added to the Known Exploited Vulnerabilities catalog following reports of active exploitation in enterprise environments. Red Hat confirmed that public exploits are actively leveraging these flaws, issuing urgent advisories and prompting federal agencies operating under Binding Operational Directive (BOD) 26-04 to apply critical kernel updates.

While attackers frequently target user-space applications to gain an initial foothold, actively weaponized kernel-level bugs give adversaries an immediate mechanism to break boundary protections, elevate privileges, or compromise host encryption.

Technical Analysis of the Exploited Vulnerabilities

The most severe flaw added to the catalog is CVE-2025-39682, rated with a maximum-impact CVSS score of 9.8. Rooted in the kernel’s handling of the Transport Layer Security (TLS) receive path—specifically categorized under CWE-754 for improper checks for unusual or exceptional conditions—the vulnerability triggers when the kernel processes malformed or unexpected TLS frames.

Although early summaries characterized the issue as requiring local authenticated access, the official CVSS v3.1 rating paints a significantly more dangerous picture: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This vector highlights an unauthenticated, low-complexity attack surface exposed directly over the network without requiring user interaction. At the time of cataloging, the flaw carries an Exploit Prediction Scoring System (EPSS) probability of 0.51% (placing it in the 42nd percentile of all tracked vulnerabilities), though this score will likely surge as automated scanning tools adopt public exploit code.

The remaining two flaws present significant local security risks:

• CVE-2026-53266 (CVSS 8.8): An out-of-bounds write flaw located in the ebtables Source Network Address Translation (SNAT) Address Resolution Protocol (ARP) rewrite path. When local processes manipulate netfilter rules or handle controlled packet structures through layer-2 bridge filtering, the missing boundary checks allow attackers to overwrite adjacent kernel memory, leading to local privilege escalation (LPE) or host denial-of-service (DoS).
• CVE-2025-39964 (CVSS 7.8): A race condition within the AF_ALG socket subsystem, which exposes the kernel’s internal cryptographic API to user-space applications. By issuing concurrent, unsynchronized writes to the same AF_ALG socket, an unprivileged local attacker can induce a state desynchronization. This desynchronization can crash the host kernel or corrupt active cryptographic operations, destroying data integrity for workloads relying on kernel-level crypto acceleration.

Convergence of Linux Kernel Threats

The active weaponization of these three bugs occurs amid a broader wave of research targeting Linux system internals. Security researcher Asim Manizada recently publicly disclosed a suite of four distinct local privilege escalation vulnerabilities impacting the kernel:

• CVE-2026-80844 (dubbed DirtyAH6)
• CVE-2026-81000 (dubbed TUNderflow)
• CVE-2026-68121 (dubbed PPPoEject)
• CVE-2026-74469 (dubbed DiagSpill)

These additional vulnerabilities span network tunneling, PPP over Ethernet handling, and kernel diagnostics interfaces. The concentration of fresh exploits in networking and cryptographic subsystems highlights an aggressive push by threat actors to find reliable post-exploitation primitives on Linux enterprise servers, container hosts, and cloud infrastructure.

Blast Radius and Operational Risk

Because these vulnerabilities reside inside core networking and cryptographic components of the Linux kernel, their blast radius spans virtually every enterprise deployment tier, including hypervisors, container nodes, web gateways, and backend database servers.

A compromised host running an unpatched kernel allows adversaries who hold unprivileged execution context—such as a compromised web application or a container with limited capabilities—to immediately gain root privileges via CVE-2026-53266 or disrupt hardware-accelerated cryptographic flows via CVE-2025-39964. If CVE-2025-39682 is exposed on systems utilizing in-kernel TLS offloading (kTLS), remote actors may be able to execute memory disclosure attacks or destabilize host networking infrastructure without prior authentication.

Remediation Guidance

System administrators must prioritize kernel updates across all affected distributions. Patching requires updating to fixed kernel branches or applying vendor-provided errata packages immediately.

• Kernel Source Fixes: Apply upstream commit patches 2902c3ebcca52ca845c03182000e8d71d3a5196f, 29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e, 3439c15ae91a517cf3c650ea15a8987699416ad9, and 62708b9452f8eb77513115b17c4f8d1a22ebf843.
• Affected Version Thresholds: Ensure Linux kernel versions are updated beyond the following vulnerable ranges:
  • 6.0 through < 6.1.149
  • 6.2 through < 6.6.103
  • 6.7 through < 6.12.44
  • 6.13 through < 6.16.4
  • Kernel release 6.17 (upgrade to non-vulnerable release point)
• Distribution Fixes: Debian 11 (bullseye) systems must upgrade debian_linux packages past version 11.0. Enterprise Red Hat systems must apply all updated security errata published on or after September 19, 2026.
• Federal Compliance: Federal Civilian Executive Branch (FCEB) organizations must complete patch deployment across all production assets by the September 21, 2026 directive deadline.