CISA Adds Three Linux Kernel Flaws to KEV: kTLS, AF_ALG and ebtables Bugs Exploited

CISA closed out the week by adding three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog in two separate alerts on 18 September 2026. All three carry a 21 September due date under BOD 26-04BOD 26-04🛡️CISA Binding Operational Directive 26-04, issued 10 June 2026, which replaced BOD 22-01. It assigns federal civilian agencies remediation deadlines of 3, 14, or 60 days based on asset exposure, KEV status, exploit automation, and post-exploitation impact, and requires forensic triage for the 3-day tier., the three-day tier reserved for flaws that hand an attacker full control of the asset, and all three are flagged for forensic triageForensic Triage🛡️A rapid, structured assessment of whether a system was compromised, performed alongside patching rather than after it. It prioritizes evidence the attacker could not have altered, such as network egress and authentication logs on other systems, over the affected host's own logs.. None of them is a fresh disclosure: the oldest was patched upstream a year ago. What changed is that CISA now has evidence someone is using them.

What Happened

The KEV feed (catalog version 2026.09.18) lists the following entries, each with vendor "Linux", product "Kernel", `dateAdded` 2026-09-18 and `dueDate` 2026-09-21:

• **CVE-2025-39682** — "Improper Check for Unusual or Exceptional Conditions" (CWE-754) in the kernel TLS receive path. A zero-length record pulled from the `rx_list` bypasses the per-`recvmsg()` record-type handling, so later records are processed with the wrong zero-copy and queuing assumptions.
• **CVE-2025-39964** — race conditionRace Condition🛡️A flaw where the outcome of code depends on the timing of concurrent operations that share state without proper synchronization. Attackers exploit kernel race conditions by winning the timing window to corrupt data structures or bypass checks. (CWE-362) in the AF_ALG crypto socket interface. Concurrent writes to the same socket interleave data unpredictably and corrupt the socket's internal state.
• **CVE-2026-53266** — out-of-bounds write (CWE-787) in the ebtables SNAT target. An ARP sender-hardware-address rewrite writes directly into a nonlinear socket-buffer fragment backed by a splice-imported file page.

CISA's alerts use the standard language: added "based on evidence of active exploitation," and kernel-level flaws "pose significant risks to the federal enterprise." Neither alert says who is exploiting the bugs, against what, or whether the three are chained together. The Hacker News, which covered the additions the same day, reached the same conclusion: no exploitation details have been published.

Red Hat updated its advisories for all three to acknowledge exploitation. According to The Hacker News, the updated Red Hat text reads: "This CVE is high risk and there are known public exploits leveraging this vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm.. Address this vulnerability with high priority." That matters because Red Hat's own severity ratings for these bugs are noticeably lower than the CNA scores, and the company chose to escalate anyway.

Who Is Affected

The honest answer is "most Linux hosts, but not equally." Each bug lives in a different subsystem with a different footprint.

**kTLS (CVE-2025-39682).** The vulnerable code is `net/tls/tls_sw.c`, the software receive path for kernel TLS. Red Hat's statement is explicit that the flaw "only affects systems with kernel TLS (CONFIG_TLS) enabled and the TLS ULP attached to TCP sockets." Distribution kernels generally ship the module, so the practical question is whether anything on the box opens a TLS socket through the kernel: high-throughputThroughput📖Actual amount of data successfully transferred over a connection, often lower than bandwidth. web servers, proxies and storage daemons that enable kTLS for offload are the obvious candidates. Per the CVE record, the bug affects kernel 6.0 and later and is fixed in 6.1.149, 6.6.103, 6.12.44, 6.16.4 and 6.17. Ubuntu marks 20.04 and earlier as not affected; 24.04 is fixed in `linux 6.8.0-86.87` and 25.04 in `linux 6.14.0-34.34`.

**AF_ALG (CVE-2025-39964).** This one has the widest version range. The CVE record traces it to a commit in 2.6.38, which means every kernel released in the last fifteen years carried it until the fixes landed in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9 and 6.17. AF_ALG is the userspace interface to the kernel's crypto API; it is loadable on demand, so any unprivileged process that can create a socket of that family can reach the vulnerable code. Ubuntu has fixes across 16.04 through 24.04 but still lists several Azure kernel packages as outstanding. The CVE record also names five Siemens products, a reminder that this code ships in industrial gear, not just servers.

**ebtables SNAT (CVE-2026-53266).** The narrowest exposure and the hardest to reason about. Triggering the write requires ebtables rules on a bridge interface that use the SNAT target's ARP hardware-address rewrite option, plus packets traversing that bridge, plus an ARP payload sitting in a nonlinear socket-buffer fragment backed by a spliced file page. SentinelOne's analysis notes that configuring the rules normally requires `CAP_NET_ADMIN`. That capability is far more common than it sounds: container runtimes, virtualization hosts and anything managing its own bridges hand it out routinely. The bug was introduced by an earlier fix for a small-packet regression, so affected ranges start at 5.4.73, 5.8.17, 5.9.2 and every 5.10+ kernel before 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36 and 7.0.13. Ubuntu has fixed 26.04 and the 24.04 HWE kernel; generic 24.04, 22.04 and 20.04 kernels were still marked in progress when checked.

Technical Analysis

The three bugs share a theme: they are local, and until this week most scoring systems treated them as moderate for exactly that reason.

CVE-2025-39682 is the standout. The Linux CNA scored it 9.8 with a network vector, NVD scored it 7.1 local, and Red Hat scored it 7.0 with a high-complexity network vector. The disagreement matters because researchers have already shown what the underlying record-type confusionType Confusion🛡️A memory-safety bug (CWE-843) in which code accesses a resource using an incompatible type, such as reading a pointer as an integer. In JavaScript engines it typically arises when optimized code trusts an assumption about an object's shape that a callback has since invalidated, as in CVE-2026-85046. buys. The bug was reported by Muhammad Alifa Ramdhan and Billy Jheng Bing-Jhong of STAR Labs, the same pair credited on the AF_ALG fix. A public write-up by a kernelCTF participant chains the closely related CVE-2024-58239 and CVE-2025-39682 into a use-after-free, sprays socket buffers to convert it into a page-level use-after-free, and finishes with an arbitrary write that overwrites `core_pattern` for root, at roughly 79 percent reliability. That is a working local root, not a denial-of-service. The step that would let a remote TLS peer trigger it is undocumented, which is why the local scores are defensible and the network score is not obviously wrong either.

CVE-2025-39964 is the least scary on paper and the most surprising KEV entry. NVD and Red Hat rate it 5.5 with availability impact only; Ubuntu has it at 3.3; the CNA says 7.8 with full confidentiality and integrity loss. The fix by Herbert Xu adds a `ctx->write` flag so a second concurrent `sendmsg()` gets `-EBUSY` instead of interleaving with the first. Interleaved writes into crypto request state are a classic route to memory corruption, and CISA's forensic-triage flag on an entry NVD considers a medium is the clearest signal in this batch that the exploitation evidence is not theoretical.

CVE-2026-53266 is a textbook missing-writability check. The Ethernet-source rewrite in `ebt_snat` was already guarded by `skb_ensure_writable()`, but the optional ARP rewrite called `skb_store_bits()` directly, and when the fragment was a spliced file page the MAC addressMAC Address🌐A unique hardware identifier assigned to every network interface. landed in page cache. The fix by Yiming Qian is three lines: extend the writability check to cover the ARP header plus the six-byte hardware address. SentinelOne says no verified public exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access. exists. Given that the primitive is a controlled six-byte write into a file-backed page, and that page-cache corruption bugs have produced some of the most reliable Linux local roots of recent years, it is not hard to see why CISA did not wait for one.

Immediate Actions

Patch, then reboot. All three are kernel fixes; live patchingLive Patching🛡️Applying a security fix to running software on an appliance or server without a full upgrade or reboot, often delivered automatically by the vendor. It shortens the exposure window but typically covers only supported releases and does not replace the full fixed release. may buy time depending on what your vendor has shipped, but the reboot debt does not go away. Our guide on why live patching perimeter appliances covers less than it seems applies with equal force to fleet servers.

If you cannot reboot inside the window, the vendor-documented stopgaps are module-level:

• Red Hat's mitigation for CVE-2025-39682 is to prevent the `tls` module from loading; for CVE-2025-39964 it is to prevent `af_alg` from loading. Both are documented under Red Hat's standard module-blacklisting solution. Understand what each disables before you do it, and read our walkthrough on how to blacklist a kernel moduleKernel Module🛡️A piece of kernel code (driver, filesystem, protocol or crypto component) that is loaded into a running Linux kernel on demand rather than compiled in. Blocking a vulnerable module from loading is a common stopgap mitigation until a patched kernel can be booted. as a stopgap mitigation first.
• Red Hat's mitigation for CVE-2026-53266 is to disable ARP hardware-address rewriting in ebtables SNAT rules, or remove SNAT rules that act on ARP traffic on bridge interfaces. SentinelOne additionally suggests restricting `CAP_NET_ADMIN` and blocking the `ebt_snat` module from loading.

For federal agencies, BOD 26-04 also requires a forensic triage of each asset to determine whether it was compromised before the patch went on. For everyone else, that is still the right instinct: a kernel local privilege escalationPrivilege Escalation🛡️An attack technique where an adversary gains elevated access rights beyond what was initially granted. is only ever the second stage of an intrusion, so the useful question is what got the attacker their unprivileged shell in the first place.

The KEV entries for the kTLS and ebtables bugs also carry CISA's end-of-life caveat, telling operators of unsupported kernels to discontinue use or move to a supported version; our piece on why end-of-life software is a standing breach risk covers the reasoning. And if you have never looked closely at what kernel TLS actually does inside your servers, our explainer on how kernel TLS moves encryptionEncryption🛡️The process of converting data into a coded format that can only be read with the correct decryption key. into the kernel and what that exposes is the place to start.

Long-Term Outlook

The uncomfortable lesson is not about any one bug. It is that "local only" kernel flaws with public proof-of-concept code are being weaponised, and the scoring systems most organisations use for triage disagreed on all three by two or more points. Anyone who filtered on a CVSS threshold of 7 using NVD's numbers would have deprioritised the AF_ALG race entirely.

The kernel's networking and crypto subsystems are also under sustained scrutiny. The Hacker News notes that researcher Asim Manizada disclosed four further Linux kernel privilege escalation flaws this same week (CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469), none yet on KEV. Read our planning piece on why the three-day KEV deadline changes how you plan kernel reboots, because this will not be the last Friday afternoon a kernel batch lands with a Sunday deadline.

Sources

• CISA KEVCISA KEV🛡️The Known Exploited Vulnerabilities catalog maintained by CISA, listing vulnerabilities actively exploited in attacks that federal agencies must patch by specific deadlines. JSON feed, catalog version 2026.09.18: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
• CISA alert, "CISA Adds Two Known Exploited Vulnerabilities to Catalog" (18 Sep 2026): https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog
• CISA alert, "CISA Adds One Known Exploited Vulnerability to Catalog" (18 Sep 2026): https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-one-known-exploited-vulnerability-catalog
• CISA BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
• CVE records (Linux CNA): https://www.cve.org/CVERecord?id=CVE-2025-39682 , https://www.cve.org/CVERecord?id=CVE-2025-39964 , https://www.cve.org/CVERecord?id=CVE-2026-53266
• NVD entries: https://nvd.nist.gov/vuln/detail/CVE-2025-39682 , https://nvd.nist.gov/vuln/detail/CVE-2025-39964 , https://nvd.nist.gov/vuln/detail/CVE-2026-53266
• Fix commits: https://github.com/torvalds/linux/commit/2902c3ebcca52ca845c03182000e8d71d3a5196f , https://github.com/torvalds/linux/commit/0f28c4adbc4a97437874c9b669fd7958a8c6d6ce , https://github.com/torvalds/linux/commit/bf84ad7c7a9ede46e31afaa41a1ba06a159e8c87
• Red Hat CVE pages: https://access.redhat.com/security/cve/CVE-2025-39682 , https://access.redhat.com/security/cve/CVE-2025-39964 , https://access.redhat.com/security/cve/CVE-2026-53266
• Ubuntu security tracker: https://ubuntu.com/security/CVE-2025-39682 , https://ubuntu.com/security/CVE-2025-39964 , https://ubuntu.com/security/CVE-2026-53266
• SentinelOne vulnerability database, CVE-2026-53266: https://www.sentinelone.com/vulnerability-database/cve-2026-53266/
• kernelCTF write-up, "CVE-2024-58239 & CVE-2025-39682 1-day analysis": https://hackmd.io/@ktranowl/Hk6u_nv6lx
• The Hacker News, "CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild": https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html
• Linux kernel documentation, Kernel TLS: https://docs.kernel.org/networking/tls.html