The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently included three significant vulnerabilities affecting the Linux kernel in its Known Exploited Vulnerabilities (KEV) catalog, pointing to evidence of these being actively exploited.
Details of the Vulnerabilities
The first vulnerability, identified as CVE-2025-39682, carries a CVSS score of 9.8 and involves an inadequate check for exceptional conditions in the TLS receive path. This flaw allows local authenticated users to potentially trigger memory leaks or denial-of-service (DoS) attacks. Meanwhile, CVE-2026-53266, with a CVSS score of 8.8, pertains to an out-of-bounds write issue in the ebtables SNAT ARP rewrite path. This vulnerability could enable a local attacker to cause unintended system behavior, DoS, or elevate their privileges locally. Lastly, CVE-2025-39964, rated at 7.8, is a race condition vulnerability that could permit concurrent writes to the same AF_ALG socket, leading to system crashes or corruption of cryptographic operations, thereby causing DoS or compromising data integrity.
Exploitation and Advisories
Despite these discoveries, details on how these vulnerabilities are being exploited in real-world scenarios remain scarce. There is also uncertainty about whether they are being used in a coordinated attack chain. In response, Red Hat has updated its advisories as of September 19, 2026, to reflect the active exploitation status of these vulnerabilities.
Red Hat has emphasized the severity of these vulnerabilities, stating, “This CVE is high risk and there are known public exploits leveraging this vulnerability. Address this vulnerability with high priority.”
Recommended Actions
In accordance with Binding Operational Directive (BOD) 26-04, which prioritizes security updates based on risk, Federal Civilian Executive Branch (FCEB) agencies have been advised to implement the necessary patches by September 21, 2026.
In related developments, security researcher Asim Manizada has disclosed four additional local privilege escalation vulnerabilities impacting the Linux kernel, further highlighting the need for vigilance and timely updates in the face of evolving threats.
As the cybersecurity landscape continues to evolve, it is crucial for organizations to remain proactive in addressing vulnerabilities, ensuring robust defenses against potential exploits.
