Linux Kernel Flaws

CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on Friday. All three are being exploited in the wild. Red Hat confirmed that in updated advisories published Saturday morning.

The flaws range from a 9.8 down to a 7.8. All three require local access to exploit. But local access is easy to get. A compromised account, a malicious container, a shared shell. That's often all it takes.

Here's what you need to know.

Quick Summary

The Three Flaws

CVE-2025-39682 (CVSS 9.8)

This one sits in the TLS receive path. The kernel doesn't check properly for unusual conditions. A local authenticated user can trigger memory disclosure or a denial of service. Memory disclosure means data that should stay private could leak. That could expose keys, credentials, or whatever happens to be in memory at the wrong moment.

CVE-2026-53266 (CVSS 8.8)

This is an out-of-bounds write in the ebtables SNAT ARP rewrite path. A local attacker can trigger unintended behavior, a denial of service, or local privilege escalation. Privilege escalation is the one that matters most. If you can turn a normal user account into root, you own the box.

CVE-2025-39964 (CVSS 7.8)

This is a race condition. Concurrent writes to the same AF_ALG socket can crash the system or corrupt cryptographic operation results. Corrupted crypto results are a quiet problem. If a cryptographic operation returns the wrong answer, the system might trust something it shouldn't.

What We Don't Know

There are no details yet on how these flaws are being exploited in the wild. It is also not clear whether these are being combined by the attackers or used individually. Red Hat updated its advisories for all three on September 19, 2026, at 2 a.m. UTC to acknowledge active exploitation. That's the trigger for the CISA listing.

"This CVE is high risk and there are known public exploits leveraging this vulnerability," Red Hat said in its advisory. "Address this vulnerability with high priority."

The Federal Deadline

CISA set a deadline of September 21, 2026, for Federal Civilian Executive Branch agencies. That's under Binding Operational Directive 26-04, which tells agencies to prioritize security updates based on risk.

That's a two-day window. Short. But that's what active exploitation looks like. When there's evidence attackers are already using a flaw, there's no time to wait.

Four More Linux Flaws Just Dropped

The same week, a researcher named Asim Manizada published details on four more local privilege escalation flaws in the Linux kernel. Each has a codename.

They are:

These aren't in the KEV catalog yet. But they're all local privilege escalation bugs. If you run Linux servers or containers, they're worth tracking. Local privilege escalation is a common step in a bigger attack. It's how a low-level foothold becomes full control.

What You Should Do

1. Patch now.

If you run Linux, check your vendor's advisories for these CVEs. Red Hat, Canonical, SUSE, and Debian have all been pushing fixes. Apply them.

2. Look at who has local access.

These flaws need local access. So ask yourself: who can log into this machine? Who can run code on it? Containers count. CI runners count. Any multi-tenant environment counts.

3. Watch for privilege escalation.

Check your logs for unusual sudo usage. Look for processes that suddenly have more privileges than they should. Watch for kernel crashes that don't have an obvious cause.

4. Don't ignore the new ones.

The four new flaws from Manizada aren't in KEV yet. But they're local privilege escalation bugs. Track them. Patch when fixes are available.

5. Segment your workloads.

If a container gets compromised, it shouldn't be able to escalate to the host. Good isolation limits the blast radius of local privilege escalation flaws.

The Bottom Line

CISA added three Linux kernel vulnerabilities to the KEV catalog. Red Hat confirmed active exploitation. Federal agencies have until September 21 to patch. The flaws are local privilege escalation and DoS issues, they need local access, but local access is easy to get. Patch now. Review who has local access. Watch for privilege escalation.

Quick Reference:

What to Do:

• Patch immediately
• Review who has local access
• Watch for privilege escalation
• Track the four new flaws
• Segment workloads

FAQ Section

What did CISA add to the KEV catalog?

Three Linux kernel flaws: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964. All three are being actively exploited.

Do I need admin privileges to exploit these?

No, they need only local privileges, but no root. User account, container, and a compromised service can be enough.

What is CVE-2026-53266?

It is an out-of-bounds write vulnerability in ebtables SNAT ARP rewrite path. This can lead to a denial of service or privilege escalation.

What is the deadline for federal agencies?

It is September 21, 2026, in the framework of Binding Operational Directive 26-04.

Are there other new Linux kernel flaws?

Yes. Researcher Asim Manizada disclosed four more local privilege escalation flaws: DirtyAH6, TUNderflow, PPPoEject, and DiagSpill.

Source: The Hacker News