CISA Adds Three Linux Kernel CVEs to KEV With Three-Day Deadline…

CISA added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities catalog on September 18, 2026, giving federal civilian agencies until September 21 to patch. The directive is driven by confirmed active exploitation, not CVSS severity alone. Red Hat has flagged CVE-2025-39682 as high risk with public exploits available.

CISA added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities catalog on September 18, 2026, imposing a three-day patch window on US federal civilian agencies — the shortest timeline allowed under Binding Operational Directive 26-04. The decision rests on confirmed evidence of active exploitation, not CVSS severity alone.

The three flaws — CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 — strike critical networking and cryptographic subsystems: the in-kernel TLS transport, ARP address rewriting in ebtables, and the AF_ALG cryptographic interface. Red Hat updated its advisories at 02:00 UTC on September 19, flagging "high risk" with known public exploits.

Key Takeaways

CISA added three Linux kernel CVEs to the KEV catalog on September 18, 2026, with confirmed active exploitation.
The deadline for FCEB agencies is September 21, 2026: three days from inclusion, the operational minimum under BOD 26-04.
Red Hat classifies CVE-2025-39682 (CVSS 9.8) as "high risk" with known public exploits and demands top priority.
The three bugs affect kTLS, ebtables SNAT, and AF_ALG — kernel subsystems with impact across cloud, enterprise servers, and embedded devices.

The kTLS-ebtables-AF_ALG Triangle: Three Flaws, Three Attack Surfaces

The distributed nature of the three vulnerabilities makes exposure assessment complex. CVE-2025-39682, rated CVSS 9.8 in the official record, sits in the kernel TLS (kTLS) receive path: an improper check on zero-length records in the rx_list bypasses recvmsg() handling, opening the door to memory disclosure or denial of service. The bug triggers only on systems with kTLS enabled, not on user-space TLS implementations such as OpenSSL.

CVE-2026-53266 (CVSS 8.8) is an out-of-bounds write in the ARP rewriting path of the ebtables SNAT target, the bridge-level filtering framework. The out-of-bounds write occurs in non-linear socket buffers during hardware address manipulation, enabling local privilege escalation. The vector requires local privileges but delivers system-wide impact.

CVE-2025-39964 (CVSS 7.8) is a race condition in the AF_ALG API, the kernel interface for cryptographic algorithms. Concurrent writes on the same AF_ALG socket allow interleaving of cryptographic data, with potential outcomes of denial of service or cryptographic stream corruption. The source does not specify whether corruption can extend to key material or confidentiality boundaries.

From CVSS to Evidence: How BOD 26-04 Flipped Priorities

The Binding Operational Directive 26-04, effective since 2023, no longer ties the deadline to severity score. The sole criterion is the existence of documented active exploitation — regardless of vector complexity or impact depth. Federal Civilian Executive Branch (FCEB) agencies must now patch by September 21, 2026, but the requirement does not stop at applying the fix.

BOD 26-04 also mandates a forensics triage to verify compromises prior to patching. This step, often overlooked in standard enterprise practice, raises the operational cost of compliance: closing the ticket is no longer enough; agencies must document the absence of intrusion. The three-day compression makes extended staging test sequences impractical.

"This CVE is high risk and there are known public exploits leveraging this vulnerability. Address this vulnerability with high priority." — Red Hat (via The Hacker News)

What to Do Now

For organizations operating under FedRAMP requirements or providing services to federal agencies, the September 21, 2026 deadline is binding. For the broader enterprise market, actions follow risk logic, not regulatory pressure.

Verify kTLS exposure. CVE-2025-39682 triggers only with in-kernel TLS transport enabled. Check whether critical services — especially those on cloud-native stacks — use kTLS instead of user-space TLS. The source provides no automated queries for this verification.

Apply kernel patches via stable channels. Official release notes from enterprise distributions (Red Hat, SUSE, Canonical) contain the corrective commits. Fix commit hashes have been published by industry sources to facilitate tracking.

Consider documented temporary mitigations. For CVE-2025-39964, blacklisting the af_alg module prevents the subsystem from loading. For CVE-2026-53266, disabling ARP hardware address rewriting in ebtables reduces the attack surface. Both carry functional impact that must be assessed case by case.

Run forensic triage before reboot. The CISA requirement for FCEB agencies is extensible to critical enterprise infrastructure: verify access logs, anomalies in kernel socket behavior, and suspicious traffic patterns prior to patching.

The Line Between Local and Systemic

The distinction between "local privilege escalation" and "remote impact" risks being misleading in cloud and containerized environments. CVE-2026-53266 and CVE-2025-39964 both require a local foothold, but in multi-tenant architectures or Kubernetes clusters the boundary between local and remote dissolves. A container compromised through another flaw immediately becomes the launch point for kernel escalation.

The case illustrates a structural tension in vulnerability management: the three CVEs do not form a documented attack chain, but their simultaneous presence in the KEV with identical deadlines suggests CISA evaluates aggregate risk, not just individual risk. The dossier does not confirm whether the vulnerabilities were used by a single actor or in coordinated campaigns.

No infrastructure overlaps emerge linking active exploitation to specific threat actors or known ransomware campaigns. Red Hat updated its advisories in under twenty-four hours from KEV inclusion, a reaction time that indicates internal pre-alert before CISA publication.

Frequently Asked Questions

Are all Linux systems vulnerable?

No. CVE-2025-39682 requires kTLS enabled; CVE-2026-53266 requires ebtables with SNAT ARP rewriting; CVE-2025-39964 requires use of AF_ALG sockets. Exposure depends on actual system configuration, not kernel version alone.

Why is the deadline so short?

BOD 26-04 sets the deadline based on evidence of active exploitation, not CVSS severity. KEV inclusion on September 18 with a September 21 deadline represents the framework's operational minimum — three business days — applied because CISA confirmed ongoing exploitation.

Are Windows or WSL affected?

The Windows kernel is not affected by these vulnerabilities. Windows Subsystem for Linux status requires separate verification against the native kernel, and it does not appear in the dossier as a documented attack surface.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter