The U.S. Cybersecurity and Infrastructure Security Agency has officially added three severe Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming that attackers are already taking advantage of these flaws in live environments.
The Vulnerabilities Exposed
The three newly listed vulnerabilities impact different subsystems of the Linux kernel and pose a variety of risks:
- CVE-2025-39682 (CVSS 9.8) — In the TLS receive path, there’s a missing check for special or unexpected conditions. Exploitation could allow local users with valid credentials to steal memory contents or trigger a denial-of-service condition.
- CVE-2026-53266 (CVSS 8.8) — An out-of-bounds write bug in the ebtables SNAT ARP rewrite path. A local attacker could exploit this to disrupt system behavior, cause DoS, or elevate privileges.
- CVE-2025-39964 (CVSS 7.8) — A race condition in AF_ALG sockets that allows concurrent writes. That can lead to system crashes or corruption of cryptographic operations, leading to DoS or integrity violations.
What’s Known and What’s Urgent
Though it’s confirmed these bugs are being exploited in the wild, details on how attackers are chaining them—or whether they’re being used together—remain unclear. Major Linux vendor Red Hat has already issued advisories for all three vulnerabilities, explicitly recognizing active exploitation and urging administrators to patch without delay.
Federal civilian agencies are required to comply with a binding directive (BOD 26-04) that mandates remediation of high-risk vulnerabilities. According to that directive, patches for these specific kernel flaws must be in place by September 21, 2026.
The listing coincides with disclosure of additional local privilege escalation flaws by a researcher, including several kernel issues known by names like DirtyAH6, TUNderflow, PPPoEject, and DiagSpill.
Attack surface matters: all three of the KEV-listed flaws need local access—either an authenticated user or a user with the ability to run code locally. That reduces exposure compared to remote exploits, but if attackers gain internal footholds (e.g. via web shells, containers, phishing), the risk rises sharply.
What this means for defenders: apply kernel updates immediately, especially in environments with multi-user access or where kernel-level crypto or network filtering are used; audit local user permissions; prepare mitigation strategies in case full patching isn’t immediately possible.
Analytical Angle: These additions show that CISA is increasingly focused on proactively flagging vulnerabilities that, while exploitable only with local access, are nonetheless being leveraged in real attacks. The deadline imposed under BOD 26-04 highlights how seriously the U.S. government treats Linux kernel flaws today—delays are no longer tolerated for high-severity bugs. What to watch: how quickly other major distributions respond, whether we see evidence of multi-step attack chains involving these flaws, and if the disclosure of the related named vulnerabilities leads to further KEV additions.
