CISA Adds Three Linux Kernel Vulnerabilities to Its Actively Exploited Catalog
Translated by a model; the original is in Russian.
On Friday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three Linux kernel flaws at once to its Known Exploited Vulnerabilities (KEV) catalog. The move was prompted by evidence that these vulnerabilities are already being used in attacks.
The three vulnerabilities
CVE-2025-39682 (CVSS score 9.8) — improper handling of exceptional conditions in the TLS receive path. A local authenticated user can trigger a disclosure of memory contents or a denial of service.
CVE-2026-53266 (CVSS 8.8) — an out-of-bounds write in the ebtables mechanism when rewriting ARP as part of source network address translation (SNAT). A local attacker can cause unintended system behavior, a denial of service, or elevate their privileges.
CVE-2025-39964 (CVSS 7.8) — a race condition allowing concurrent writes to a single AF_ALG socket. This makes it possible to crash the system or corrupt the results of cryptographic operations, threatening a denial of service and a loss of data integrity.
Attack details not yet disclosed
Exactly how these vulnerabilities are being exploited, and whether they are linked into a single attack chain, has not been publicly reported. However, on September 19, 2026, Red Hat updated its advisories for all three CVEs, acknowledging active exploitation. «This vulnerability carries a high risk, and public exploits leveraging it are known. Remediate with high priority,» the company's recommendations state.
Under Binding Operational Directive BOD 26-04, which governs risk-based prioritization of updates, federal civilian agencies are ordered to install the necessary fixes by September 21, 2026.
The news comes against the backdrop of a publication by researcher Asim Manizada, who disclosed four more privilege escalation vulnerabilities in the Linux kernel. All of them were given catchy names: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), and CVE-2026-74469 (DiagSpill).
Source: The Hacker News
Comments
Sign in, to comment.