CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on September 18, 2026, citing evidence of active exploitation. Red Hat updated its advisories for all three flaws early the following morning (September 19, 2 a.m. UTC) to acknowledge in-the-wild attacks. Federal Civilian Executive Branch agencies have until September 21, 2026 to remediate — a two-to-three day window that signals CISA considers exploitation to be ongoing and not merely theoretical.

What happened

The three CVEs span unrelated kernel subsystems — TLS socket handling, netfilter bridge NAT, and the AF_ALG crypto API — which makes them read less like a single attack chain and more like a threat actor (or actors) systematically working through a backlog of known kernel bugs to find what still works against unpatched fleets. CISA has not published details on the specific exploitation methods or attributed the activity to a named actor or campaign, and it’s unconfirmed whether any of the three are being weaponized together.

Technical details

  • CVE-2025-39682 (CVSS 9.8) — An improper check for unusual or exceptional conditions in the kernel’s TLS receive path. A local, already-authenticated user can trigger the flaw to cause memory disclosure or denial-of-service. The 9.8 rating on what requires local access reflects how severe the resulting memory corruption/disclosure can be once triggered, not that it’s remotely reachable pre-auth.
  • CVE-2026-53266 (CVSS 8.8) — An out-of-bounds write in the netfilter bridge ebtables SNAT target’s optional ARP sender hardware address (SHA) rewrite path. The vulnerable code calls skb_store_bits() to write into a socket buffer without first confirming the target range is writable. When the ARP SHA field lands in a nonlinear skb fragment backed by a splice-imported file page, the write hits the underlying page directly — corrupting memory belonging to unrelated kernel objects or userspace mappings. Exploitable by a local attacker for DoS or privilege escalation on hosts running ebtables SNAT rules.
  • CVE-2025-39964 (CVSS 7.8) — A race condition in the AF_ALG crypto socket datapath. The kernel allows two writers on the same AF_ALG socket concurrently, letting request payloads interleave unpredictably. A local attacker can use this to crash the system or corrupt cryptographic operation results, producing DoS or data-integrity failures in anything relying on kernel-accelerated crypto through that interface.

All three require local access to trigger — none are remote, pre-auth vectors. That’s consistent with how these get used in the wild: as the privilege-escalation or persistence step after an attacker already has a foothold (compromised container, web shell, low-privilege account), turning limited access into root or a crash that masks other activity.

Affected: Upstream Linux kernel branches carrying the vulnerable TLS, netfilter bridge, and AF_ALG code prior to the fixing commits; check your distribution’s advisory for exact kernel-version ranges (Red Hat, Debian, Ubuntu, SUSE have all shipped or are shipping backports) Attack vector: Local, requires an existing authenticated session or code-execution foothold Added to KEV: September 18, 2026 FCEB remediation deadline: September 21, 2026

Impact

Because exploitation requires local access, the direct blast radius is anywhere untrusted or semi-trusted code already runs: multi-tenant Linux hosts, shared build/CI runners, container platforms where a contained process could reach host kernel interfaces, and any environment where an attacker has already landed via a separate initial-access bug. In those settings these three bugs are exactly the kind of “boring” kernel primitive that turns a contained incident into a full host compromise — privilege escalation to root, a crash that disrupts detection or masks activity, or corrupted crypto state that undermines integrity guarantees elsewhere in the stack. Given CISA’s compressed FCEB deadline, treat the KEV listing as confirmation that this isn’t a theoretical local-only risk — someone is actively using it.

Mitigation

  1. Patch now. Pull the latest kernel build from your distribution — Red Hat, Debian, Ubuntu, and SUSE have all issued or are issuing updated advisories referencing these three CVEs specifically. Don’t wait for a routine patch cycle given the active-exploitation status and FCEB’s 3-day window.
  2. Prioritize multi-tenant and CI/build hosts. Since all three require local access, systems that run untrusted code from multiple parties (shared runners, container hosts, jump boxes) are the highest-value patch targets.
  3. Restrict ebtables SNAT usage where not required — reducing the attack surface for CVE-2026-53266 on hosts that don’t need bridge-level NAT with ARP rewriting.
  4. Audit for unexpected privilege escalation or crashes on hosts that can’t be patched immediately: watch for unexplained kernel panics, new root processes spawned from low-privilege sessions, or AF_ALG-related crypto errors in dmesg/kern.log.
  5. Track your distro’s kernel advisory for the exact fixed package version — kernel patch numbering varies significantly across distributions and LTS branches.

References