The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned that attackers are actively exploiting three Linux kernel vulnerabilities, creating an urgent patching and investigation deadline.
CISA added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its Known Exploited Vulnerabilities catalog on September 18, 2026, with remediation required by September 21 under Binding Operational Directive 26-04.
The KEV catalog tracks vulnerabilities exploited in real-world attacks, while BOD 26-04 requires covered federal civilian agencies to accelerate remediation based on operational risk.
CISA also marked all three vulnerabilities as requiring forensic triage, meaning affected agencies must investigate potentially exposed assets for evidence of compromise rather than treating patch installation as the only response activity.
Linux Kernel Vulnerabilities Actively Exploited
The most severe issue, CVE-2025-39682, is a critical improper-condition check in the Linux kernel’s Transport Layer Security receive path. The CVE record assigns it a CVSS score of 9.8 and describes a corner case in which a zero-length record retrieved from the rx_list bypasses intended recvmsg() record-type handling. Subsequent TLS records could therefore be processed using incorrect zero-copy and queuing assumptions.
The flaw is relevant when kernel TLS, commonly called kTLS, is enabled and attached to TCP sockets. Red Hat says the affected code path can be triggered remotely when this functionality is used, making internet-accessible services employing kTLS a particularly important remediation priority.
At the source-code level, the vulnerability breaks an important receive-path rule: one recvmsg() operation should process either contiguous data records or a single non-data record. When the initial queued record has zero length, the type-transition check may be skipped, potentially producing unsafe socket-buffer state.
Upstream stable-kernel patches are available, but administrators should use distribution-provided kernel packages containing the fix instead of assessing exposure solely through generic version numbers.
CVE-2026-53266 is a high-severity out-of-bounds write vulnerability in the netfilter bridge ebtables SNAT target, carrying a CVSS score of 8.8. During an optional Address Resolution Protocol sender hardware-address rewrite, the kernel may call skb_store_bits() without ensuring the destination range is writable. If that data remains in a nonlinear socket-buffer fragment backed by a splice-imported file page, the operation can write directly into the underlying page.
Red Hat warns that a local attacker targeting a system configured with specific bridge netfilter rules could trigger memory corruption, denial of service, or potential privilege escalation. The upstream correction ensures that the ARP sender hardware-address range is writable before the kernel reads the ARP header and performs the modification.
CVE-2025-39964 is a race condition in the kernel’s AF_ALG cryptographic interface. Concurrent writes to the same AF_ALG socket can become unpredictably interleaved and leave its internal state inconsistent.
The vulnerability carries a CVSS score of 7.8, with its vector indicating a local, low-privilege attack path and potentially high confidentiality, integrity, and availability impact. The fix adds exclusive write ownership so only one writer can use sendmsg() at a time.
CISA has not publicly identified the attackers, victims, or exploitation techniques associated with these incidents, and ransomware involvement remains unknown. The lack of campaign details does not reduce the risk because KEV inclusion confirms that exploitation has occurred in the wild.
Organizations should install vendor-provided kernel updates, reboot into the corrected kernel, and verify the active version afterward. Where patches are unavailable, CISA advises applying vendor mitigations, following cloud-specific BOD 26-04 guidance, or discontinuing unsupported products.
Temporary protections may include disabling unused kTLS functionality, removing ARP-rewriting ebtables SNAT rules, restrictingCAP_NET_ADMIN, or preventing the af_alg module from loading after carefully evaluating operational impact.
Before remediation, security teams should preserve relevant telemetry and inspect exposed systems for kernel crashes, suspicious privilege changes, unexpected namespace activity, and unauthorized netfilter modifications.
With the September 21 deadline approaching, defenders should combine rapid patching with forensic assessment to determine whether vulnerable Linux systems were compromised before fixes were deployed.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
