CISA Gives Agencies Three Days to Patch Three Exploited Linux Kernel Flaws

CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on 18 September 2026, citing evidence that all three are being exploited in the wild, and gave federal civilian agencies until 21 September to fix them. The roughly 72-hour window is far shorter than the three weeks agencies typically receive for KEV entries.

Related reading: Cisco Firewalls Are Under Active Attack, and CISA Just Set a 48-Hour Clock · CISA Flags PolyShell as Exploited While the Magento Campaign Hits Hundreds of Stores.

The three flaws sit in unrelated parts of the kernel, which is what makes the addition unusual. They are CVE-2025-39682, a flaw in the kernel TLS receive path rated 9.8; CVE-2026-53266, an out-of-bounds write in the netfilter bridge ebtables SNAT target rated 8.8; and CVE-2025-39964, a race condition in the AF_ALG cryptographic socket interface rated 7.8. CISA published them in two alerts on the same day: one covering CVE-2025-39682 and a second covering the other two.

All three were flagged as requiring forensic triage under Binding Operational Directive 26-04, meaning agencies must investigate whether their systems were already compromised rather than treating a patch as the end of the response. CISA did not disclose who is exploiting the flaws, which organisations have been hit, or what techniques were used. None of the entries was marked as linked to ransomware.

Three very different bugs

CVE-2025-39682 is the most severe on paper and the broadest in reach. It concerns kernel TLS, a feature that moves TLS record processing into kernel space for efficiency. The bug involves the handling of zero-length records pulled from the receive queue, which can break an assumption that later code makes about whether data has already been decrypted. Red Hat's advisory notes that the affected logic can be triggered by data arriving over the network on systems where kTLS is attached to TCP sockets, which puts internet-facing services that rely on kernel TLS acceleration at the front of the queue for review.

CVE-2026-53266 is narrower but more serious when it applies. It is an out-of-bounds write in the ebtables SNAT target in the bridge netfilter code, which rewrites network addresses on bridged traffic. When an optional feature rewrites the ARP sender hardware address, the kernel can write to memory without first confirming the destination is writable, and in some cases that memory is backed by a socket-buffer fragment tied to a file imported through a splice operation. Exploiting it requires specific bridge netfilter rules and, in many analyses, capabilities equivalent to CAP_NET_ADMIN, which narrows the affected population but includes containerised workloads and network appliances that grant that capability to service processes.

CVE-2025-39964 is the most accessible for a local attacker. It is a race condition in AF_ALG, the interface that lets user-space programs use kernel cryptographic primitives directly. The interface did not enforce exclusive ownership of the write path on a socket, so two threads or processes writing concurrently could interleave their operations and leave the kernel's internal cryptographic state inconsistent. The result can be a crash or corrupted cryptographic output, which is a data-integrity problem as well as a denial-of-service one. The flaw was reportedly present in the kernel for around 14 years and was found by STAR Labs, which demonstrated privilege escalation and container escape in Google's kernelCTF contest and said it did not use AI to find it.

Red Hat's warning and the patch picture

Red Hat updated its advisories around 19 September to acknowledge active exploitation. In advisories for each flaw the company said the vulnerability is high risk and that there are known public exploits, urging customers to address it with high priority. Patches are available across supported kernel branches, and Red Hat has published fixes including RHSA-2025:16880 and RHSA-2025:16904 for CVE-2025-39682 and RHSA-2026:36645, RHSA-2026:39082 and RHSA-2026:39083 for CVE-2026-53266.

For CVE-2026-53266 there is a mitigation short of patching: disabling ARP hardware address rewriting in ebtables SNAT rules, or removing SNAT rules that operate on ARP traffic on bridge interfaces. For CVE-2025-39964 no working mitigation is available other than applying the patch, according to Red Hat. Because the bugs are in the mainline kernel rather than a single distribution's packaging, the exposure spans RHEL, Ubuntu, Debian and other kernel-derived systems to varying degrees depending on the kernel version and configuration each one ships.

One detail is worth separating from the vendor messaging. CVE-2026-53266 has not been demonstrated with public exploit code, and analyses have inferred the privilege-escalation chain by analogy with Dirty Pipe rather than by showing a working attack. That does not contradict CISA's finding that the flaw has been exploited, but it means defenders should treat the public exploit picture as incomplete.

Why the deadline was so short

BOD 26-04 changed how CISA prioritises federal patching. Rather than sorting vulnerabilities by CVSS score alone, it weighs four variables including whether a flaw is known to be exploited. The Linux kernel additions are a clear illustration: CVE-2025-39964 would look like a mid-severity local bug under a score-first process, but confirmed exploitation and the forensic-triage requirement put it on the same 72-hour clock as a 9.8-rated flaw.

For organisations outside the US federal government, the KEV listing is a signal rather than a mandate. The affected kernel features are common enough that the practical advice is straightforward: identify Linux hosts and containers running vulnerable kernel versions, prioritise systems where kTLS is attached to TCP sockets, where bridge netfilter rules use ebtables SNAT with ARP rewriting, and where workloads invoke AF_ALG directly. Because patching a package does not change a running kernel, teams should confirm the kernel version after updating and reboot where needed.

A practical checklist

The three flaws require different exposure to be exploitable, so defenders can triage rather than panic. The kernel TLS bug is the one to prioritise on internet-facing systems, because Red Hat says it can be triggered by network traffic on hosts that have kTLS attached to TCP sockets. Services that terminate TLS in the kernel for performance, including some proxies, load balancers and storage systems, are the first place to look. Checking whether kTLS is in use is a configuration question, and hosts that do not use it are not exposed through that path.

The ebtables flaw is more situational. It needs bridge netfilter rules that perform SNAT with ARP hardware address rewriting, and the exploitation analyses suggest it also requires privileges equivalent to CAP_NET_ADMIN. Container hosts, virtualisation nodes and network appliances that hand that capability to service processes are the most likely to be affected. A short-term mitigation is to disable ARP hardware address rewriting in ebtables SNAT rules or remove SNAT rules that act on ARP traffic on bridge interfaces.

The AF_ALG race is a local issue, which means the attacker needs code running on the host already. It matters most in multi-tenant and container environments where a low-privileged process could race the kernel's cryptographic socket handling. There is no mitigation short of patching, and because the flaw is a race condition, its practical exploitability varies with workload and timing.

Across all three, the forensic-triage requirement is the part that is easy to skip. A patch closes the door but does not tell you whether someone came through it. Organisations that treat the KEV deadline as the end of the job may miss evidence of prior compromise, which is exactly what CISA's directive is designed to prevent.

What to watch

The first question is what attackers are actually doing with these flaws. CISA has not published indicators of compromise or threat-intelligence detail, so defenders are working from the KEV listing alone. If forensic triage turns up evidence of exploitation at federal agencies, more detail may follow.

The second is whether the flaws were used together. The kernel TLS bug is remotely triggerable in the right configuration, the ebtables bug can lead to privilege escalation, and the AF_ALG bug is a local race. A chain that starts remotely and escalates locally would be more dangerous than any single flaw, and no public reporting has yet connected them.

The third is the broader pattern. Three unrelated kernel bugs exploited at once, with a 72-hour deadline, is a reminder that the Linux kernel's attack surface is large and that patch cycles for infrastructure software can lag behind exploitation. For teams running Linux at scale, the useful takeaway is to shorten the gap between a kernel advisory and a reboot, because the next KEV addition is a matter of when rather than if.

Cover: Wikimedia Commons photo of an Arch Linux system update via pacman on an Acer laptop by Solijon Solayev (CC BY-SA 4.0).