CISA adds three exploited Linux kernel flaws to its list
CISA has listed three already-exploited Linux kernel vulnerabilities in its Known Exploited Vulnerabilities catalogue, giving US federal agencies until Monday to patch them.
Three Linux kernel vulnerabilities joined CISA's Known Exploited Vulnerabilities catalogue on 18 September, in the same release as catalogue version 2026.09.18. All three are flagged for forensic triage, all three have a due date of 21 September 2026 under binding operational directive BOD 26-04, and all three are listed as already exploited rather than merely exploitable.
What each flaw actually does
CVE-2025-39682 is the most severe at 9.8. A zero-length record retrieved from the receive list in the kernel's TLS receive path bypasses the intended record-type handling in recvmsg(), which can leave later TLS records processed under the wrong zero-copy and queuing assumptions. The catalogue points at five stable-branch commits as the fix.
CVE-2026-53266, rated 8.8, is an out-of-bounds write in the ebtables SNAT target. An ARP sender hardware address rewrite can write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page, turning a bridge-networking code path into classic memory corruption. CISA notes that affected products may be end of life and that users should move to a supported version.
CVE-2025-39964, rated 7.8, is a race condition in the kernel's AF_ALG cryptographic socket interface. Two concurrent writes to the same socket interleave unpredictably and corrupt the socket's internal state, a bug the fix commit describes as bogus by design rather than merely untidy.
Why kernel flaws sit at the bottom of everything
The kernel is underneath container hosts, VPN gateways, appliances, Android devices and every distribution built from a stable branch, which is why CISA's note for all three entries warns that they affect an open-source component that can be pulled into unrelated products. The fix links resolve to Linux stable commits rather than to vendor packages, so the practical work belongs to whoever builds or maintains the kernel that a product ships with.
Nothing in the catalogue says how the three are being exploited, by whom, or whether they are being chained together. CISA lists no ransomware association for any of them, which in this catalogue means unconfirmed rather than ruled out.
Our opinion
The scores look modest next to the perfect 10.0 vulnerabilities that make headlines, but severity is the wrong lens here. A flaw that is already being exploited jumps to the front of the queue whatever its number, and a four-day federal deadline is the clearest signal CISA issues that something is in active use. The uncomfortable part is the audience. Three stable-branch commits is a clean, bounded fix for anyone running their own kernel, and an awkward one for anyone running somebody else's kernel inside a device that updates on the vendor's schedule. Kernel flaws are rarely about the patch; they are about who can apply it.