The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal civilian executive branch (FCEB) agencies address these flaws by September 21, 2026. This directive, issued under Binding Operational Directive (BOD) 22-01, aims to mitigate significant risks posed by actively exploited vulnerabilities. Private sector organizations are also encouraged to review the catalog and apply necessary patches.
The first vulnerability, CVE-2025-39682, carries a CVSS score of 9.8 and is described as an improper check for unusual or exceptional conditions. This flaw resides in the TLS receive path of the Linux Kernel and could allow authenticated local users to expose sensitive memory contents or trigger a denial-of-service (DoS) condition.
The second vulnerability, CVE-2026-53266, has a CVSS score of 8.8 and involves an out-of-bounds write. This memory corruption issue is found in the ebtables SNAT ARP rewrite path. Exploitation could lead to unexpected system behavior, system crashes, or privilege escalation for a local attacker.
Finally, CVE-2025-39964, with a CVSS score of 7.8, is a race condition vulnerability. This synchronization flaw affects AF_ALG sockets, where simultaneous write operations can interfere with each other. Such interference could result in system crashes or compromise the integrity of cryptographic operations.
As of the current reporting, specific details regarding how these three vulnerabilities are being exploited in the wild, or whether they are being chained together in sophisticated attacks, have not been disclosed. However, their inclusion in CISA's KEV catalog signifies that they are actively being used by threat actors.
