CISA Adds Three Linux Kernel Flaws to KEV: kTLS, AF_ALG and ebtables Bugs Exploited
Security

CISA Adds Three Linux Kernel Flaws to KEV: kTLS, AF_ALG and ebtables Bugs Exploited

CISA put three Linux kernel bugs on KEV with a 21 September deadline: a kTLS record-handling flaw with a public root exploit, an AF_ALG race, and an ebtables SNAT out-of-bounds write.

AB
Anthony Bahn IT Director & Cybersecurity Consultant
linux kernelcisa kevprivilege escalationktlspatch management

CISA closed out the week by adding three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog in two separate alerts on 18 September 2026. All three carry a 21 September due date under BOD 26-04, the three-day tier reserved for flaws that hand an attacker full control of the asset, and all three are flagged for forensic triage. None of them is a fresh disclosure: the oldest was patched upstream a year ago. What changed is that CISA now has evidence someone is using them.

What Happened

The KEV feed (catalog version 2026.09.18) lists the following entries, each with vendor "Linux", product "Kernel", dateAdded 2026-09-18 and dueDate 2026-09-21:

  • CVE-2025-39682: "Improper Check for Unusual or Exceptional Conditions" (CWE-754) in the kernel TLS receive path. A zero-length record pulled from the rx_list bypasses the per-recvmsg() record-type handling, so later records are processed with the wrong zero-copy and queuing assumptions.
  • CVE-2025-39964: race condition (CWE-362) in the AF_ALG crypto socket interface. Concurrent writes to the same socket interleave data unpredictably and corrupt the socket's internal state.
  • CVE-2026-53266: out-of-bounds write (CWE-787) in the ebtables SNAT target. An ARP sender-hardware-address rewrite writes directly into a nonlinear socket-buffer fragment backed by a splice-imported file page.

CISA's alerts use the standard language: added "based on evidence of active exploitation," and kernel-level flaws "pose significant risks to the federal enterprise." Neither alert says who is exploiting the bugs, against what, or whether the three are chained together. The Hacker News, which covered the additions the same day, reached the same conclusion: no exploitation details have been published.

Red Hat updated its advisories for all three to acknowledge exploitation. According to The Hacker News, the updated Red Hat text reads: "This CVE is high risk and there are known public exploits leveraging this vulnerability. Address this vulnerability with high priority." That matters because Red Hat's own severity ratings for these bugs are noticeably lower than the CNA scores, and the company chose to escalate anyway.

Who Is Affected

The honest answer is "most Linux hosts, but not equally." Each bug lives in a different subsystem with a different footprint.

kTLS (CVE-2025-39682). The vulnerable code is net/tls/tls_sw.c, the software receive path for kernel TLS. Red Hat's statement is explicit that the flaw "only affects systems with kernel TLS (CONFIG_TLS) enabled and the TLS ULP attached to TCP sockets." Distribution kernels generally ship the module, so the practical question is whether anything on the box opens a TLS socket through the kernel: high-throughput web servers, proxies and storage daemons that enable kTLS for offload are the obvious candidates. Per the CVE record, the bug affects kernel 6.0 and later and is fixed in 6.1.149, 6.6.103, 6.12.44, 6.16.4 and 6.17. Ubuntu marks 20.04 and earlier as not affected; 24.04 is fixed in linux 6.8.0-86.87 and 25.04 in linux 6.14.0-34.34.

AF_ALG (CVE-2025-39964). This one has the widest version range. The CVE record traces it to a commit in 2.6.38, which means every kernel released in the last fifteen years carried it until the fixes landed in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9 and 6.17. AF_ALG is the userspace interface to the kernel's crypto API; it is loadable on demand, so any unprivileged process that can create a socket of that family can reach the vulnerable code. Ubuntu has fixes across 16.04 through 24.04 but still lists several Azure kernel packages as outstanding. The CVE record also names five Siemens products, a reminder that this code ships in industrial gear, not just servers.

ebtables SNAT (CVE-2026-53266). The narrowest exposure and the hardest to reason about. Triggering the write requires ebtables rules on a bridge interface that use the SNAT target's ARP hardware-address rewrite option, plus packets traversing that bridge, plus an ARP payload sitting in a nonlinear socket-buffer fragment backed by a spliced file page. SentinelOne's analysis notes that configuring the rules normally requires CAP_NET_ADMIN. That capability is far more common than it sounds: container runtimes, virtualization hosts and anything managing its own bridges hand it out routinely. The bug was introduced by an earlier fix for a small-packet regression, so affected ranges start at 5.4.73, 5.8.17, 5.9.2 and every 5.10+ kernel before 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36 and 7.0.13. Ubuntu has fixed 26.04 and the 24.04 HWE kernel; generic 24.04, 22.04 and 20.04 kernels were still marked in progress when checked.

Technical Analysis

The three bugs share a theme: they are local, and until this week most scoring systems treated them as moderate for exactly that reason.

CVE-2025-39682 is the standout. The Linux CNA scored it 9.8 with a network vector, NVD scored it 7.1 local, and Red Hat scored it 7.0 with a high-complexity network vector. The disagreement matters because researchers have already shown what the underlying record-type confusion buys. The bug was reported by Muhammad Alifa Ramdhan and Billy Jheng Bing-Jhong of STAR Labs, the same pair credited on the AF_ALG fix. A public write-up by a kernelCTF participant chains the closely related CVE-2024-58239 and CVE-2025-39682 into a use-after-free, sprays socket buffers to convert it into a page-level use-after-free, and finishes with an arbitrary write that overwrites core_pattern for root, at roughly 79 percent reliability. That is a working local root, not a denial-of-service. The step that would let a remote TLS peer trigger it is undocumented, which is why the local scores are defensible and the network score is not obviously wrong either.

CVE-2025-39964 is the least scary on paper and the most surprising KEV entry. NVD and Red Hat rate it 5.5 with availability impact only; Ubuntu has it at 3.3; the CNA says 7.8 with full confidentiality and integrity loss. The fix by Herbert Xu adds a ctx->write flag so a second concurrent sendmsg() gets -EBUSY instead of interleaving with the first. Interleaved writes into crypto request state are a classic route to memory corruption, and CISA's forensic-triage flag on an entry NVD considers a medium is the clearest signal in this batch that the exploitation evidence is not theoretical.

CVE-2026-53266 is a textbook missing-writability check. The Ethernet-source rewrite in ebt_snat was already guarded by skb_ensure_writable(), but the optional ARP rewrite called skb_store_bits() directly, and when the fragment was a spliced file page the MAC address landed in page cache. The fix by Yiming Qian is three lines: extend the writability check to cover the ARP header plus the six-byte hardware address. SentinelOne says no verified public exploit exists. Given that the primitive is a controlled six-byte write into a file-backed page, and that page-cache corruption bugs have produced some of the most reliable Linux local roots of recent years, it is not hard to see why CISA did not wait for one.

Immediate Actions

Patch, then reboot. All three are kernel fixes; live patching may buy time depending on what your vendor has shipped, but the reboot debt does not go away. Our guide on why live patching perimeter appliances covers less than it seems applies with equal force to fleet servers.

If you cannot reboot inside the window, the vendor-documented stopgaps are module-level:

  • Red Hat's mitigation for CVE-2025-39682 is to prevent the tls module from loading; for CVE-2025-39964 it is to prevent af_alg from loading. Both are documented under Red Hat's standard module-blacklisting solution. Understand what each disables before you do it, and read our walkthrough on how to blacklist a kernel module as a stopgap mitigation first.
  • Red Hat's mitigation for CVE-2026-53266 is to disable ARP hardware-address rewriting in ebtables SNAT rules, or remove SNAT rules that act on ARP traffic on bridge interfaces. SentinelOne additionally suggests restricting CAP_NET_ADMIN and blocking the ebt_snat module from loading.

For federal agencies, BOD 26-04 also requires a forensic triage of each asset to determine whether it was compromised before the patch went on. For everyone else, that is still the right instinct: a kernel local privilege escalation is only ever the second stage of an intrusion, so the useful question is what got the attacker their unprivileged shell in the first place.

The KEV entries for the kTLS and ebtables bugs also carry CISA's end-of-life caveat, telling operators of unsupported kernels to discontinue use or move to a supported version; our piece on why end-of-life software is a standing breach risk covers the reasoning. And if you have never looked closely at what kernel TLS actually does inside your servers, our explainer on how kernel TLS moves encryption into the kernel and what that exposes is the place to start.

Long-Term Outlook

The uncomfortable lesson is not about any one bug. It is that "local only" kernel flaws with public proof-of-concept code are being weaponised, and the scoring systems most organisations use for triage disagreed on all three by two or more points. Anyone who filtered on a CVSS threshold of 7 using NVD's numbers would have deprioritised the AF_ALG race entirely.

The kernel's networking and crypto subsystems are also under sustained scrutiny. The Hacker News notes that researcher Asim Manizada disclosed four further Linux kernel privilege escalation flaws this same week (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469), none yet on KEV. Read our planning piece on why the three-day KEV deadline changes how you plan kernel reboots, because this will not be the last Friday afternoon a kernel batch lands with a Sunday deadline.

Sources

  • CISA KEV JSON feed, catalog version 2026.09.18: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
  • CISA alert, "CISA Adds Two Known Exploited Vulnerabilities to Catalog" (18 Sep 2026): https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog
  • CISA alert, "CISA Adds One Known Exploited Vulnerability to Catalog" (18 Sep 2026): https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-one-known-exploited-vulnerability-catalog
  • CISA BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
  • CVE records (Linux CNA): https://www.cve.org/CVERecord?id=CVE-2025-39682 , https://www.cve.org/CVERecord?id=CVE-2025-39964 , https://www.cve.org/CVERecord?id=CVE-2026-53266
  • NVD entries: https://nvd.nist.gov/vuln/detail/CVE-2025-39682 , https://nvd.nist.gov/vuln/detail/CVE-2025-39964 , https://nvd.nist.gov/vuln/detail/CVE-2026-53266
  • Fix commits: https://github.com/torvalds/linux/commit/2902c3ebcca52ca845c03182000e8d71d3a5196f , https://github.com/torvalds/linux/commit/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce , https://github.com/torvalds/linux/commit/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87
  • Red Hat CVE pages: https://access.redhat.com/security/cve/CVE-2025-39682 , https://access.redhat.com/security/cve/CVE-2025-39964 , https://access.redhat.com/security/cve/CVE-2026-53266
  • Ubuntu security tracker: https://ubuntu.com/security/CVE-2025-39682 , https://ubuntu.com/security/CVE-2025-39964 , https://ubuntu.com/security/CVE-2026-53266
  • SentinelOne vulnerability database, CVE-2026-53266: https://www.sentinelone.com/vulnerability-database/cve-2026-53266/
  • kernelCTF write-up, "CVE-2024-58239 & CVE-2025-39682 1-day analysis": https://hackmd.io/@ktranowl/Hk6u_nv6lx
  • The Hacker News, "CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild": https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html
  • Linux kernel documentation, Kernel TLS: https://docs.kernel.org/networking/tls.html
← Back to all news