CISA Urges Immediate Patching of Three Actively Exploited Linux Kernel Flaws
Cybersecurity and Infrastructure Security Agency (CISA) added three high-severity Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on September 18, 2026, citing documented exploitation in the wild.
- The Core Issue: Three separate Linux kernel flaws allowing denial-of-service, memory disclosure, and privilege escalation are actively exploited in production environments.
- The Deadline: Federal Civilian Executive Branch (FCEB) agencies were given an urgent three-day patching window expiring on September 21, 2026, under Binding Operational Directive (BOD) 26-04.
- The Action: Systems must be upgraded immediately using stable upstream kernel patches or explicit module mitigations to prevent unauthenticated remote or local system compromise.
Anatomy of the Three Exploited Kernel Flaws
According to vulnerability tracking data and announcements detailed by The Hacker News, the catalog additions comprise CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964. Each flaw introduces distinct systemic attack vectors into standard Linux kernel deployments.
The most severe of the group, CVE-2025-39682, holds a CVSS score of 9.8 out of 10. Reported as an improper check for unusual or exceptional conditions within the TLS receive path, it allows unauthenticated threat actors to trigger memory disclosure or complete denial-of-service (DoS) attacks. According to Red Hat advisories, this vulnerability might even be remotely triggerable under specific configurations utilizing kernel TLS (kTLS).
The second vulnerability, CVE-2026-53266, carries an 8.8 CVSS score. Documented as an out-of-bounds write flaw in the ebtables Source Network Address Translation (SNAT) Address Resolution Protocol (ARP) rewrite path, it permits local attackers to mount denial-of-service states or achieve local privilege escalation. Meanwhile, CVE-2025-39964 features a 7.8 CVSS score and stems from a race condition enabling concurrent writes to the same AF_ALG socket. Local actors can abuse this race condition to crash the host or corrupt cryptographic operation results, creating severe data integrity issues.
Production Risk Analysis and Enterprise Triage
Red Hat confirmed active exploitation of all three vulnerabilities in real-world scenarios, issuing warnings urging administrators to treat updates with high priority.
For CVE-2025-39682, administrators can deploy temporary mitigations by blacklisting the tls kernel module to prevent it from loading. For CVE-2026-53266, mitigation requires removing or modifying ebtables SNAT rules that handle ARP traffic on bridge interfaces. However, CVE-2025-39964 lacks a viable intermediate mitigation strategy, requiring an immediate kernel upgrade to restore system security.
Upstream Patch Availability and Implementation Mandate
Upstream maintainers have released fixes across multiple stable and long-term support branches. For instance, CVE-2025-39682 has been remediated in stable releases 6.1.149, 6.6.103, 6.12.44, and 6.16.4.
To verify current kernel versions and confirm whether an active system runs a vulnerable build, administrators can execute standard query commands in the terminal:
uname -r
dpkg -l linux-image-generic | grep ii
*Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.*