Linux Kernel Security Issues

Key Takeaways:

• CISA added three Linux kernel flaws to its Known Exploited Vulnerabilities catalog on September 18, 2026: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, with confirmed active exploitation.
• Under BOD 26-04, CVE-2025-39682 carried a three-day deadline for all assets; the other two were due in three days for publicly exposed assets and 14 days for internal systems.
• CVE-2026-53266 is an out-of-bounds write in the bridge netfilter ebtables SNAT target that can corrupt memory backing splice-imported file pages.
• Red Hat confirmed public exploits for CVE-2025-39682 and CVE-2026-53266; CISA marked all three as requiring forensic triage.
• Kernel-level flaws undermine the container isolation boundary, since containers share the host kernel rather than running their own.

Three Kernel Flaws Enter CISA’s Exploited List

When the Department of Homeland Security’s CISA announced on September 18, 2026, that it had added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, it marked a stark reality. These flaws weren’t just theoretical, they were actively exploited in the wild. The vulnerabilities affected critical systems used by government agencies and large enterprises alike. Two of these flaws appeared in a single alert, CVE-2025-39964 and CVE-2026-53266, while the third, CVE-2025-39682, was added on the same day. These vulnerabilities target different parts of the kernel: the TLS receive path, the bridge netfilter ebtables module, and the AF_ALG cryptographic socket interface.

Severity ratings for these flaws vary widely. SecurityWeek reports CVE-2025-39682 at CVSS 9.8, CVE-2026-53266 at 8.8, and CVE-2025-39964 at 7.8. However, the CVSS score isn’t the only measure of urgency. The TechTimes analysis of the CISA KEV additions notes that the NVD assigns CVE-2025-39964 a baseline score of just 3.3 (Low), while Red Hat rates it as Medium (5.5), and the CVE Naming Authority assigns it a High (7.8). The KEV listing remains the authoritative indicator of active exploitation risk.

Red Hat’s advisories confirm that all three vulnerabilities are actively exploited and that public exploits are available. For CVE-2025-39682, Red Hat’s advisory explicitly states that exploit code is in the wild, and similar confirmation exists for CVE-2026-53266. CISA’s directive to conduct forensic triage underscores the need for organizations to examine affected assets carefully, rather than just applying patches blindly.

Inside CVE-2026-53266: A Missing Writability Check

CVE-2026-53266 resides in the bridge netfilter subsystem, specifically within the ebt_snat target that allows ebtables rules to rewrite the source MAC address in bridged Ethernet frames. The vulnerability stems from a missing check for writability before performing an in-place write. When the target processes an ARP packet, it calls skb_header_pointer() to safely read the ARP header, which only grants read access. The subsequent skb_store_bits() call attempts to write the new MAC address at an offset relative to skb->data without verifying that this memory region is writable, as detailed in SentinelOne’s analysis.

The issue arises when the ARP sender’s hardware address is stored in a nonlinear socket buffer fragment backed by a splice-imported file page. The write operation maps that fragment page and modifies shared memory directly, which can corrupt kernel memory associated with unrelated objects or user-space mappings. This flaw can lead to local privilege escalation through kernel memory corruption. An attacker must have the ability to configure ebtables rules and craft packets that traverse a bridge with the SNAT ARP rewrite option, typically requiring CAP_NET_ADMIN.

Researcher Kimmo Suominen published a technical analysis and a patch-status tracker for this flaw, outlining a potential privilege-escalation chain involving file-backed memory. Suominen notes that the exploit chain is inferred by analogy with Dirty Pipe and has not been demonstrated with public exploit code. Nonetheless, CISA’s KEV listing confirms active exploitation, so defenders should prioritize patching even if the full exploit isn’t publicly available yet.

kTLS and AF_ALG: The Other Two Flaws

CVE-2025-39682 affects the kernel’s implementation of TLS record processing on the receive side, located in net/tls/tls_sw.c. When an application configures a TCP socket with TCP_ULP set to