Three Exploited Linux Kernel Flaws Trigger Immediate CISA Patch Deadline

Active exploitation moves three kernel bugs to the front of patch queues

CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, setting a remediation deadline of September 21, 2026 for US federal agencies.

The entries—CVE-2025-39682, CVE-2025-39964, and CVE-2026-53266—entered the catalog on September 18, 2026. They affect unrelated parts of the kernel: TLS receive processing, AF_ALG cryptographic sockets, and bridge Netfilter ebtables SNAT handling.

CISA’s action confirms exploitation, but little is known about the attacks. No exploitation telemetry, indicators of compromise, attacker identities, malware families, targeted sectors, or proof-of-concept details have been disclosed. Public information also does not establish whether attackers are combining the vulnerabilities into one chain.

The three flaws have materially different prerequisites:

Vulnerability	Component	CVSS	Access indicated by CVSS
CVE-2025-39682	Kernel TLS receive path	9.8	Network, no privileges
CVE-2025-39964	AF_ALG cryptographic sockets	7.8	Local, low privileges
CVE-2026-53266	ebtables SNAT ARP rewriting	8.8	Local, low privileges

Organizations should therefore avoid treating them as a single exposure. A server using kernel TLS, a local multi-user Linux host, and a bridge running ebtables present different attack surfaces.

A zero-length TLS record can break receive-path assumptions

CVE-2025-39682 is the most severe of the three. Its vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, describes a network-reachable issue requiring neither authentication nor user interaction.

The vulnerability arises in the kernel TLS receive path and its handling of records queued on rx_list. A recvmsg() call is expected to process either contiguous DATA records or a single non-DATA record. Some records, including TLS 1.3 records whose type becomes known only after decryption, may already be decrypted before being placed on the list for a later call.

Zero-copy processing writes decrypted content directly into a user-space buffer. Because that path accepts only DATA records, the implementation assumed the record type could not change after decryption. The logic fails when the first record taken from rx_list has a length of zero, leaving an exceptional condition improperly checked.

Reported outcomes include memory exposure and denial of service. Some accounts describe exploitation by authenticated local users, but that characterization conflicts with the CVE’s network attack vector. Until more attack data becomes available, defenders should preserve that distinction rather than assuming exploitation is limited to local access.

The flaw begins at Linux 6.0 and does not affect earlier releases. Fixed branch versions are:

• 6.1.149 and later in the 6.1.x series
• 6.6.103 and later in the 6.6.x series
• 6.12.44 and later in the 6.12.x series
• 6.16.4 and later in the 6.16.x series
• Linux 6.17, which is listed as unaffected

The vulnerable code starts at commit 84c61fe1a75b4255df1e1e7c054c9e6d048da417. NVD also associates Debian Linux 11.0 with the CVE, although that product association is not included in the kernel.org CVE record.

Concurrent AF_ALG writes can corrupt cryptographic state

CVE-2025-39964 is a race condition in af_alg_sendmsg, part of the AF_ALG interface that exposes kernel cryptographic operations through sockets.

Two threads writing simultaneously to the same AF_ALG socket can interleave data unpredictably and leave the socket’s internal state inconsistent. The correction adds a ctx->write field so that one writer has exclusive ownership during the operation.

The consequences can include kernel crashes, denial of service, and corrupted or unreliable cryptographic results. Its vector, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, requires local access and low privileges but assigns high impact across confidentiality, integrity, and availability.

The affected code begins with commit 8ff590903d5fc7f5a0a988c38267a3d08e6393a2, introduced at Linux 2.6.38. Earlier kernels are unaffected. Fixed versions are:

• 5.10.245 and later in 5.10.x
• 5.15.194 and later in 5.15.x
• 6.1.154 and later in 6.1.x
• 6.6.108 and later in 6.6.x
• 6.12.49 and later in 6.12.x
• 6.16.9 and later in 6.16.x
• Linux 6.17

NVD additionally lists Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP and 1518F-4 PN/DP MFP, including firmware entries. Those associations do not appear in the kernel.org CVE record. Operators should verify Siemens-specific firmware guidance rather than assuming that a generic kernel package update covers an embedded device.

A crafted ARP payload can reach an unsafe ebtables write

CVE-2026-53266 is an out-of-bounds write in the bridge Netfilter ebtables SNAT target. The vulnerable path can rewrite an ARP sender hardware address inside a nonlinear socket-buffer fragment without first ensuring that the relevant memory is writable.

At bridge ebtables hooks, the Ethernet header is accessed through skb_mac_header() or eth_hdr(), while skb->data points at the Ethernet payload. Simply requesting ETH_HLEN writable bytes would validate the payload rather than the header and would revive the small-packet regression addressed by commit 63137bc5882a. The dangerous operation is the optional ARP rewrite.

A crafted packet containing an ARP payload can consequently cause memory modification outside the intended packet buffer. Possible effects include crashes, unexpected behavior, memory corruption, and privilege-related impact.

The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. It specifies local access, low privileges, no user interaction, and a changed security scope.

NVD identifies Linux kernels earlier than 5.5 as affected. A branch-by-branch CVE Program record with precise fixed versions is not available, so administrators should use distribution and appliance vendor advisories when validating remediation.

Version strings alone may not establish exposure

The fixed upstream versions provide reliable boundaries for standard kernel branches, but many distributions backport security corrections without changing to the listed upstream release. Conversely, embedded products may carry vendor modifications that complicate direct comparisons.

Asset owners should examine package changelogs, vendor advisories, backported commit identifiers, and firmware build information. This is especially relevant to Debian Linux 11.0 and the Siemens SIMATIC products identified by NVD.

The additions also follow several other KEV entries associated with Linux, Debian, or Siemens during the preceding 90 days: CVE-2026-87886 on September 16, 2026, CVE-2025-25249 on September 9, 2026, CVE-2026-53362 on August 27, 2026, and CVE-2022-0995 on August 26, 2026.

Patch first, then investigate for behavioral evidence

CISA instructs organizations to apply vendor mitigations, comply with BOD 26-04, “Prioritizing Security Updates Based on Risk,” and follow its Forensics Triage Requirements. Applicable cloud-service guidance must also be followed. Where no mitigation exists, the required action is to discontinue use of the affected product.

Other reporting connects the deadline to BOD 22-01, “Reducing the Significant Risk of Known Exploited Vulnerabilities.” Organizations documenting compliance should retain both references while following the action text attached to each KEV entry.

Response teams should prioritize CVE-2025-39682 because of its network vector and 9.8 score, while rapidly addressing the two local flaws on shared systems, appliances, container hosts, and machines where untrusted users can execute code.

No vulnerability-specific indicators have been published. Hunting should instead focus on:

• Kernel crashes, unexplained reboots, and memory-corruption symptoms
• Abnormal TLS service failures or receive-path errors
• Unexpected AF_ALG use and failed or inconsistent cryptographic operations
• Changes in bridge or ebtables activity
• Unusual ARP traffic or malformed ARP payloads
• Evidence that low-privileged local processes preceded system instability

KEV inclusion establishes that exploitation is occurring. It does not reveal which systems were targeted or how attackers reached the vulnerable code, making patch validation and host-level forensic review equally necessary.