Linux kernel: three exploited CVEs enter the KEV catalogue

On 18 September 2026, the Cybersecurity and Infrastructure Security Agency, CISA (1), published two separate alerts adding three CVEs (2) to its Known Exploited Vulnerabilities catalogue, KEV (3). The first added CVE-2025-39682; the second added CVE-2025-39964 and CVE-2026-53266. The three entries carry the same date added, the same remediation due date of 21 September 2026 and the same note: forensic triage required under directive BOD (4) 26-04. The field on use in ransomware campaigns reads “unknown” for all three.

The three vulnerabilities sit in distinct kernel subsystems: the in-kernel TLS (5) receive path, known as kTLS, for CVE-2025-39682; the SNAT (6) target of ebtables on network bridges for CVE-2026-53266; the AF_ALG interface, which exposes the kernel’s cryptographic algorithms to user processes, for CVE-2025-39964. None is a zero-day: the Linux kernel CNA (7) published them on 5 September 2025, 25 June 2026 and 13 October 2025 respectively, with the corresponding fixes in the stable branches. Debian and Ubuntu have shipped fixes for all three. At Red Hat, the data snapshot mirrored by OpenCVE listed RHEL 9 and RHEL 10 as affected by CVE-2025-39682 and CVE-2026-53266, and a deferred fix for CVE-2025-39964 from RHEL 7 to RHEL 10; the date of that snapshot is not known and the current state is to be checked on the vendor’s page.

CISA has published no detail on the exploitation observed, nor on any chaining of the three flaws. Red Hat updated its three advisories on 19 September at 02:00 UTC to reflect active exploitation, according to The Hacker News and Secure in Seconds; the reported wording describes CVE-2025-39682 as high risk with known public exploits. That statement does not appear in the version of the Red Hat pages retrieved for this article.

CISA groups the three entries under the label “Linux Kernel”, but they share neither the same vector, nor the same preconditions, nor the same age. The table reproduces the values published by the kernel CNA, taken from the original records: CWE (8) category, introduced and fixed versions, condition of access to the flaw.

Fig. 1: the three CVEs, their CWE category, the introduced and fixed versions published by the kernel CNA, and the condition of access to the flaw.

CVE-2025-39682, the kTLS receive path

The kernel can terminate the TLS sessions of a TCP socket itself when the application attaches the TLS upper-layer protocol to it; this is kTLS mode, used by OpenSSL when built with that option, by NFS (9) with TLS, and by the SMB (10) and RPC (11) transports with TLS through the kernel’s net/handshake mechanism. Each recvmsg() call must process either a run of DATA records or a single record of another type. The defect lies in a corner case: when the first record processed comes from the rx_list queue and is zero-length, the type check is bypassed and the following records are processed under zero-copy and queueing assumptions that no longer hold.

The rationale published by the CNA with its score describes the triggering sequence: three consecutive records sent by the remote peer, a DATA record, a zero-length record of another type, then a DATA record. The effect is deterministic, with no race to win and no dependency on memory layout, and the regression test added with the fix reproduces it in one pass. The consequences described are a copy of freed kernel memory to user space, a write-after-free on the stream’s anchor structure, a double free at socket teardown and a kernel crash. Zero-copy mode is enabled by default in TLS 1.2, so no particular option is needed on the victim side.

The fix initialises and checks the content type on each call and stops processing as soon as a non-DATA record follows a DATA record. Announced on 5 September 2025 with the fixes for the 6.1, 6.6, 6.12 and 6.16 branches, it was shipped by Debian in advisories DSA-6008-1 and DSA-6009-1 and by Ubuntu in the USN-7833 series and later. Red Hat states that the defect is reachable only when the kTLS protocol is attached to a socket, and proposes as a mitigation to prevent the tls module from loading.

CVE-2026-53266, the ARP rewrite of the ebtables SNAT target

On a Linux network bridge, ebtables can rewrite the source MAC (12) address of frames through the SNAT target. That rewrite of the Ethernet header is guarded by a call to skb_ensure_writable(). The option of the same target that also rewrites the sender hardware address inside ARP (13) messages is not: it writes through skb_store_bits() at an offset relative to the start of the payload, whereas the preceding read of the ARP header through skb_header_pointer() does not guarantee that the target range is writable. If that range sits in a non-linear fragment of the socket buffer backed by a file page imported through splice(), the six bytes of the new MAC address are written straight into the page-cache page.

The CNA’s score retains a local vector: the attacker must control the bridge and ebtables configuration and arrange the shared fragments themselves; remote ARP traffic alone is not enough. The required capability, CAP_NET_ADMIN, is reachable from a user and network namespace without being root in the initial namespace, which explains the low privilege level retained and the scope change: the corruption reaches file-backed pages beyond the boundary of the networking subsystem.

The fix makes the hardware-address range writable before reading the ARP header and before calling skb_store_bits(). It dates from 25 June 2026; Debian shipped it in advisories DLA-4664-1, DLA-4665-1 and DLA-4671-1 in July 2026, Ubuntu in the USN-8726 series and later. The CNA record lists no fixed version for the 5.4, 5.8 and 5.9 branches, where the original commit had been backported. The KEV catalogue carries for this entry, as for CVE-2025-39682, the note that the affected products may be end-of-life or end-of-service. Red Hat proposes as a mitigation to remove the ARP rewrite from SNAT rules, or to remove SNAT rules that apply to ARP traffic on bridges.

CVE-2025-39964, concurrent writes on AF_ALG

AF_ALG is the socket family through which a user process submits operations to the kernel’s cryptographic API (14). Two concurrent sendmsg() calls on the same socket interleave their data unpredictably and leave the socket’s internal state inconsistent. The fix adds a ctx->write field that reserves writing to a single caller at a time. It dates from 13 October 2025; Debian shipped it in advisory DSA-6053-1 and in advisories DLA-4379-1 and DLA-4404-1, Ubuntu in the USN-7907 series and later.

The original description speaks only of interleaving and inconsistency. The scoring rationale added by the CNA in July 2026 is more precise: the attacker controls both sides of the race, with two threads on a socket they own, and can park the first writer deterministically by sizing the send buffer. The socket(), bind() and key-setting calls require no capability, the needed modules are loaded on demand, and an unprivileged user, including inside a container, can reach them. The race produces an out-of-bounds scatterlist entry, then used to read kernel memory and to write chosen data into it, which the CNA describes as a primitive suitable for privilege escalation. Red Hat summarises the impact as denial of service and corruption of cryptographic results; the KEV entry repeats the original description without qualifying the impact; CISA’s SSVC (15) enrichment retains a total technical impact. Red Hat proposes as a mitigation to prevent the af_alg module from loading.

Each CVE carries up to three CVSS (16) 3.1 scores: that of the kernel CNA, published on cve.org with a metric-by-metric rationale; that of the NVD (17), which produced its own score for two of the three records; that of Red Hat, computed for its own products. The differences bear on the attack vector, not only on severity. The Red Hat pages display the three values side by side, which allows them to be read in one place.

Fig. 2: CVSS 3.1 scores published by the three sources for each CVE, and SSVC decision values published by CISA. Values read on 20 September 2026.

For CVE-2025-39682, the CNA and Red Hat retain a network vector, the attacker being the TLS peer; NVD retains a local vector with low privileges. All three readings rest on the same record text. Red Hat lowers the confidentiality and integrity impact to low and raises the attack complexity, which gives 7.0 where the CNA obtains 9.8. For CVE-2026-53266, the situation is reversed: the CNA retains a local vector and a scope change, Red Hat a network vector with high complexity. For CVE-2025-39964, NVD and Red Hat retain an availability impact only, the CNA a full impact on all three criteria.

These scores have moved over time. According to the history kept by OpenCVE, the kernel CNA raised CVE-2025-39682 from 7.1 to 9.8 and CVE-2025-39964 from 3.3 to 7.8 on 30 July 2026, publishing on that occasion the metric-by-metric rationale quoted above. The latter CVE had been lowered from 5.5 to 3.3 in February 2026. EPSS (18) scores remain low at the time of writing: 1.2% for CVE-2025-39682, 0.79% for CVE-2025-39964, 0.28% for CVE-2026-53266, while all three are exploited.

BOD 26-04, issued on 10 June 2026, replaces BOD 22-01 of November 2021 and BOD 19-02. It applies to US federal civilian executive branch agencies, known as FCEB (19). The flat remediation deadline for KEV entries gives way to a table of sixteen combinations of four variables: public exposure of the asset, presence in the KEV catalogue, automation of the exploitation, total or partial technical impact. Deadlines range from three calendar days to remediation at the next system upgrade. The shortest combinations add an obligation: a forensic triage of the asset, to establish whether the system was compromised before the fix was applied.

The implementation guidance states that CISA itself computes the due date entered in the KEV catalogue by applying that table to the data it holds, public exposure included, and that the catalogue’s due date prevails. That computation is what yields 21 September 2026 for the three entries, three days from 18 September. Two of the three CVEs are not automatable in CISA’s sense; active exploitation and total impact were enough to trigger the shortest tier, which matches the reading of the table published by Tenable, according to which presence in the KEV catalogue and total impact are sufficient for that tier. The guidance also states that CISA adds to the catalogue the indicators of compromise it holds; at the time of writing, the alerts publish none and the sources consulted report none.

The directive’s schedule gives agencies until 7 December 2026 to apply the table’s deadlines in full, according to the summary published by the FedRAMP programme, which does not prevent the 21 September due date from appearing in the catalogue. For organisations outside the directive’s scope, that due date has no binding value; it indicates the priority level CISA assigns to these three flaws in light of what it observes. In the text accompanying the directive, CISA cited Verizon’s 2026 DBIR: 26% of KEV catalogue vulnerabilities fully remediated in 2025, against 38% the year before.

The catalogue additions and the technical data come from primary sources. The circumstances of the exploitation are documented by none of them.

Fig. 3: status of each item used in the article according to the number and nature of the sources establishing it.

Within three days

• Read the running kernel on every host with uname -r, not the version held by the inventory or the deployment manifest. Compare the result with the distribution’s advisories, which number their kernels their own way: the upstream versions in the table of section 2 do not map directly onto a Debian, Ubuntu, Red Hat or SUSE version string.
• Order by what the host can reach: hypervisors, container hosts, continuous integration runners holding deployment secrets, bastions, before workstations.
• Plan the reboot together with the update: all three fixes are kernel code changes, and the mitigations proposed by Red Hat remove the module or option concerned rather than closing the flaw with the function kept. The distributions’ live-patching mechanisms apply where they are in place.

Per CVE

• CVE-2025-39682: identify the hosts that terminate TLS in the kernel. The tls module loaded and non-zero counters in /proc/net/tls_stat indicate kTLS sessions; the candidates are web servers configured with kTLS, NFS servers and clients with TLS, and services using net/handshake. Failing a fix, prevent the tls module from loading as Red Hat proposes, at the cost of losing the function.
• CVE-2026-53266: list the ebtables rules in the nat table on hosts carrying bridges, with ebtables -t nat -L or its nftables equivalent. The flaw requires a SNAT target with the --snat-arp option; removing that option or preventing the ebt_snat module from loading closes the path described. Since CAP_NET_ADMIN is reachable from a user namespace according to the CNA, restricting the creation of unprivileged user namespaces reduces the surface on hosts that do not need them; that restriction has to be tested, as some container environments depend on it.
• CVE-2025-39964: treat as exposed any unpatched host where an unprivileged user can run code, containers included. Preventing the af_alg module from loading closes the path, but deprives the applications that use the kernel crypto API through that interface, for instance libkcapi or OpenSSL’s afalg engine. That mitigation has to be verified before deployment.

Beyond the fix

• Conduct the forensic triage on hosts that were exposed before remediation, even outside the directive’s scope. With no indicator published, the triage rests on generic signals: kernel crashes and error messages in the logs, modules loaded for no known reason, namespaces or bridges created by accounts that have no use for them, and kTLS connections to unexpected peers.
• Extend the inventory to industrial and embedded equipment: Siemens lists the SIMATIC CN 4100 before version V5.0 for CVE-2025-39682, and the SIMATIC S7-1500 CPU 1518-4 and 1518F-4 PN/DP MFP as well as their SIPLUS variant from version V3.1.6 for CVE-2025-39964.
• Treat the three-day deadline as a priority indicator rather than an obligation, except for entities subject to the directive; the four-variable model of BOD 26-04 transposes to any organisation able to say which of its assets are exposed.

1. CISA (1): Cybersecurity and Infrastructure Security Agency, the US cybersecurity and infrastructure security agency.
2. CVE (2): Common Vulnerabilities and Exposures, unique public identifier of a vulnerability.
3. KEV (3): Known Exploited Vulnerabilities, catalogue maintained by CISA of vulnerabilities for which exploitation has been observed.
4. BOD (4): Binding Operational Directive, compulsory CISA directive applicable to US federal civilian agencies.
5. TLS (5): Transport Layer Security, communications encryption protocol; kTLS denotes its implementation inside the Linux kernel.
6. SNAT (6): Source Network Address Translation, rewriting of the source address; in ebtables, the target that rewrites the source MAC address of frames.
7. CNA (7): CVE Numbering Authority, entity authorised to assign CVE identifiers within its scope, here the Linux kernel CVE team.
8. CWE (8): Common Weakness Enumeration, classification of software weakness types.
9. NFS (9): Network File System, file-sharing protocol whose recent versions can be carried over TLS.
10. SMB (10): Server Message Block, file and print sharing protocol.
11. RPC (11): Remote Procedure Call, mechanism for calling procedures across systems.
12. MAC (12): Media Access Control, hardware address of a network interface.
13. ARP (13): Address Resolution Protocol, protocol mapping IP addresses to MAC addresses on a local network.
14. API (14): Application Programming Interface, programmatic access interface to a service.
15. SSVC (15): Stakeholder-Specific Vulnerability Categorization, decision method used by CISA, whose exploitation, automation and technical impact values feed BOD 26-04.
16. CVSS (16): Common Vulnerability Scoring System, standardised framework for rating the severity of a vulnerability.
17. NVD (17): National Vulnerability Database, US vulnerability database maintained by NIST, which publishes its own score.
18. EPSS (18): Exploit Prediction Scoring System, estimate of the probability that a vulnerability is exploited within thirty days.
19. FCEB (19): Federal Civilian Executive Branch, US federal civilian agencies subject to CISA directives.

1. CISA, CISA Adds One Known Exploited Vulnerability to Catalog, 18 September 2026. cisa.gov
2. CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog, 18 September 2026. cisa.gov
3. CISA, Known Exploited Vulnerabilities Catalog, accessed 20 September 2026. cisa.gov
4. CISA, BOD 26-04 Prioritizing Security Updates Based on Risk, 10 June 2026. cisa.gov
5. CISA, BOD 26-04 Implementation Guidance for Prioritizing Security Updates Based on Risk, 10 June 2026. cisa.gov
6. Linux kernel CVE team, CVE-2025-39682 announcement on linux-cve-announce, 5 September 2025. lore.kernel.org
7. Linux kernel CVE team, CVE-2025-39964 announcement on linux-cve-announce, 13 October 2025. lore.kernel.org
8. Linux kernel CVE team, CVE-2026-53266 announcement on linux-cve-announce, 25 June 2026. lore.kernel.org
9. CVE Program, records for CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266, CNA score with metric-by-metric rationale and CISA ADP enrichment, accessed 20 September 2026. cve.org
10. OpenCVE, records for the three CVEs with score change history, accessed 20 September 2026. opencve.io
11. Red Hat, CVE-2025-39682, accessed 20 September 2026. access.redhat.com
12. Red Hat, CVE-2026-53266, accessed 20 September 2026. access.redhat.com
13. Red Hat, CVE-2025-39964, accessed 20 September 2026. access.redhat.com
14. Siemens ProductCERT, advisories SSA-032379 (SIMATIC CN 4100) and SSA-019113 (SIMATIC S7-1500). cert-portal.siemens.com
15. The Hacker News, CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild, 19 September 2026. thehackernews.com
16. Secure in Seconds, Three Linux kernel bugs hit CISA’s exploited list the same day four public root exploits landed, 20 September 2026. secureinseconds.com
17. Tenable, CISA BOD 26-04: Frequently asked questions about the new risk-based patching directive, 11 June 2026. tenable.com
18. FedRAMP, FedRAMP Response to CISA BOD 26-04, 16 June 2026. fedramp.gov
19. exploit-intel.com, CVE-2026-53266 record, analysis of the repository referenced as a PoC, accessed 20 September 2026. exploit-intel.com