CISA adds three actively Exploited Linux kernel flaws to Known Exploited Vulnerabilities catalog

The Cybersecurity and Infrastructure Security Agency added three actively exploited Linux kernel vulnerabilities—CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964—to its Known Exploited Vulnerabilities catalog on Friday, citing active exploitation confirmed in the wild.

The flaw tracked as CVE-2025-39682 sits in the Linux kernel TLS receive path in net/tls/tls_sw.c, specifically tls_sw_recvmsg(), and affects versions 6.0 through 6.16.3 plus release candidates 6.17-rc1 and 6.17-rc2. It lets a zero-length initial record get past type-change detection, producing a use-after-free when the socket closes and the code walks freed memory. Kernel TLS offload lets the kernel decrypt incoming TLS records and deliver plaintext directly to applications, bypassing userspace libraries such as OpenSSL.

CVE-2026-53266, published June 25, 2026, is in the bridge netfilter’s ebt_snat target and stems from a missing writability check that precedes a memory write operation. While handling an ARP packet, ebt_snat reads the header using skb_header_pointer() and writes using skb_store_bits() into skb->data, which can corrupt kernel memory in unrelated objects. Exploitation generally requires CAP_NET_ADMIN, a privilege for network administration, and the documented impact is local privilege escalation through kernel memory corruption.

CVE-2025-39964, published Oct. 13, 2025, affects the AF_ALG interface, which exposes cryptographic operations to userspace through socket-like file descriptors; it reaches kernel versions 2.6.38 through 6.16.9 and 6.17-rc6. It is a race condition in which two writers can touch the same AF_ALG socket at once, leaving the per-socket context inconsistent and leading to corrupted crypto output, a kernel panic, or denial of service.

STAR Labs, based in Singapore, discovered CVE-2025-39682. A public proof-of-concept triggering a KASAN-confirmed use-after-free is circulating. It has circulated since September 2025, which left vulnerable systems exposed for up to a year before the catalog addition.

Severity ratings for the flaws vary by source. Tech Times rates CVE-2025-39682 at 7.1 High, pointing to a local attack vector, low privilege needs, and no required user interaction; The Hacker News puts it at 9.8. For CVE-2025-39964, the NVD puts the score at 3.3 Low, Red Hat at 5.5 Medium, and the CVE Naming Authority on cve.org at 7.8 High; The Hacker News also lists 7.8.

Binding Operational Directive 26-04, issued June 10, 2026, sets aside a three-day remediation tier for flaws that score highest on public internet exposure, confirmed exploitation, exploit automation, and the potential to compromise a full system. It replaces Binding Operational Directive 22-01 from 2021 and Binding Operational Directive 19-02 from 2019.

The directive covers only Federal Civilian Executive Branch agencies and contractors running covered systems, while CISA’s guidance is advisory for the private sector. Under the directive, agencies in the Federal Civilian Executive Branch must apply fixes by Sept. 21, 2026, and it requires forensic triage before patching to check whether an attacker compromised an asset first. CISA says private-sector organizations should rank fixes using the Known Exploited Vulnerabilities catalog because CISA includes catalog entries only after confirmed real-world exploitation.

All three fixes require a kernel update and then a reboot. For CVE-2025-39682, configuration changes alone cannot fix it; the only non-patch option is turning kTLS off entirely. Servers running kernel TLS offload should receive the highest priority, particularly in multi-tenant environments; administrators can spot them through setsockopt(SOL_TLS) usage or application configuration. Live-patching tools, including kpatch for Red Hat and Canonical Livepatch for Ubuntu, can apply kernel fixes without a reboot, though coverage hinges on vendor release schedules.

Red Hat’s interim mitigation for CVE-2025-39964 blacklists the af_alg module, disabling all kernel-mediated cryptography for dependent applications; administrators can also block the af_alg module from loading when immediate patching is not possible. For CVE-2026-53266, administrators should review ebtables rules using bridge ebtables and SNAT rules for ARP rewriting, then limit CAP_NET_ADMIN access to trusted processes. Under CISA’s KEV guidance, hosts patched after exposure to CVE-2025-39682 should undergo forensic triage to determine whether exploitation happened before the fix.

Researcher Asim Manizada disclosed four more local privilege escalation flaws in the Linux kernel that same week: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469). CISA has not added those four flaws to the KEV catalog, so it has not confirmed active exploitation for them. The disclosures point to sustained attacker interest in Linux kernel networking and cryptographic subsystems.

The three kernel flaws span unrelated subsystems—the kernel TLS receive path, the bridge netfilter ebtables module, and the cryptographic user API—so the agency views the threat as broad, not narrow. Binding Operational Directive 26-04 swapped the old flat-deadline approach, which relied only on CVSS severity, for a four-variable risk model that weighs internet exposure, KEV presence, exploit automatable nature, and the potential to compromise a full system.

Under Binding Operational Directive 22-01, patching was the end state; Binding Operational Directive 26-04 instead requires mandatory forensic triage to check for compromise before patching. Researchers have probed the kTLS receive path over the past year, frequently implicating the zero-copy optimization path.

The 2026 Verizon Data Breach Investigations Report found that full remediation of KEV vulnerabilities covered just 26 percent in 2025, compared with 38 percent in 2024, while the median time to finish remediation reached 43 days. The number of KEV vulnerabilities organizations had to address rose 50 percent in 2025 from the previous year. First-week remediation rates have stayed between 30 percent and 40 percent across organizations for three years.

Red Hat said the flaws are actively exploited and shipped updated advisories for all three of them on Sept. 19, 2026, at 2 a.m. UTC. The Red Hat Enterprise Linux 9 patch is RHSA-2025:16880 and the RHEL 10 patch is RHSA-2025:16904, while CVE-2026-53266 fixes are RHSA-2026:36645, RHSA-2026:39082, and RHSA-2026:39083. Red Hat said, “Address this vulnerability with high priority.”