CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch them or stop using affected products by Sept. 21.. The flaws are CVE-2025-39682, CVE-2026-53266 and CVE-2025-39964, with severity scores of 9.8, 8.8 and 7.8, respectively.
All three have available patches, and Red Hat said they are being actively exploited.. Red Hat described all three issues as high risk in its advisories. “This CVE is high risk and there are known public exploits leveraging this vulnerability.
Address this vulnerability with high priority,” it said for each flaw.. CISA added the vulnerabilities to the catalog on Sept. 18, 2026.
The agency gave Federal Civilian Executive Branch agencies three days to remediate them, a shorter deadline than the three weeks it usually allows.. CVE-2025-39682 affects the TLS receive path in the kernel and is an improper check flaw that could let unauthenticated attackers cause memory disclosure or denial-of-service attacks.
Red Hat said the bug may be remotely triggerable when a system uses the affected kernel TLS receive path.. Fixes for CVE-2025-39682 are included in stable kernel releases 6.1.149, 6.6.103, 6.12.44 and 6.16.4. A mitigation is available by preventing the tls module from being loaded..
CVE-2026-53266 is an out-of-bounds write flaw in the ebtables source network address translation ARP rewrite path. The vulnerability can allow local attackers to escalate privileges or launch denial-of-service attacks.. The flaw has been fixed upstream and backported to supported stable and distribution branches including 5.10.259, 6.1.176 and 6.12.94.
Users can mitigate exposure by disabling ARP hardware address rewriting in ebtables SNAT rules or removing SNAT rules that operate on ARP traffic on bridge interfaces.. CVE-2025-39964 is a race condition affecting concurrent writes to the same AF_ALG socket. The flaw can let local attackers crash systems or corrupt cryptographic operation results, creating data integrity issues and possible denial-of-service conditions..
Fixes for CVE-2025-39964 are available in releases 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9. No mitigation is currently available beyond applying the patch.. No details were disclosed about who is exploiting the vulnerabilities, which systems have been targeted or how the exploits have been used.
The source material said no separate public reports of attacks tied to the three flaws had surfaced.. Earlier this year, security researchers disclosed four other Linux local privilege escalation flaws: DirtyAH6, tracked as CVE-2026-80844, TUNderflow, tracked as CVE-2026-81000, PPPoEject, tracked as CVE-2026-68121, and DiagSpill, tracked as CVE-2026-74469..
Featured image credit. Tags: CISAlinux
