CISA gives agencies one business day to patch three exploited Linux kernel flaws
The three kernel CVEs CISA added to its exploited-bugs catalog on Friday all need local access, and the lowest-scored of them is the one STAR Labs used for privilege escalation and container escape. Red Hat has confirmed public exploit code.
The Watch · Security desk
What happened
- CISA added CVE-2025-39682, CVE-2026-53266 and CVE-2025-39964 to its Known Exploited Vulnerabilities catalog on Friday, citing evidence of active exploitation, with a federal due date of September 21, 2026.
- CVE-2025-39964, a race condition in the kernel's AF_ALG cryptographic socket interface, had been in the Linux kernel for 14 years before STAR Labs reported it.
- Red Hat updated its advisories for all three flaws as of September 19 at 2 a.m. UTC to acknowledge active exploitation.
- CISA also marked all three as requiring forensic triage, so agencies must examine every affected asset for signs that exploitation already occurred.
- None of the three is currently flagged in the catalog as exploited by ransomware groups.
Why it matters
- What it limits constraint All three need code already running on the host. They upgrade a foothold to root or out of a container, and the exposure lives in host and image inventory, not in perimeter scan results.
- What it costs cost The triage half of the order costs more than the patch half: logs and disk images for every Linux host in scope, on the same deadline, from the same staff who are applying the kernel updates.
- Who's exposed exposure A working container escape puts multi-tenant container hosts in scope, where one compromised workload reaches the kernel every other tenant on the box shares.
- What doesn't add up contradiction Security Affairs cites BOD 22-01 for the September 21 date while The Hacker News cites BOD 26-04; under the first the fix is required, under the second it is recommended, and an agency reading only one has a different obligation.
Next story · Security · yesterday
CISA gives agencies until October 17 to fix four exploited bugs in Cisco, Palo Alto and Ahsay productsConfirmed3 publishers
Rank the three by what an attacker has been shown to do with them and the severity order inverts. CVE-2025-39682 holds the 9.8 and the public exploit code, and its documented outcomes are memory disclosure or denial of service for a local authenticated user [8][11]. CVE-2025-39964 holds a 7.8, and STAR Labs used it to escalate privileges and escape a container in Google's kernelCTF [9][17].
The AF_ALG flaw needs two writes to the same cryptographic socket. The data interleaves unpredictably and leaves the socket's internal state inconsistent enough to crash the machine or corrupt the result of a cryptographic operation [14][9]. STAR Labs said its researchers found the issue with no help from an AI system [16].
CVE-2026-53266 is where public evidence and vendor language diverge. The bug writes an ARP sender hardware address straight into a nonlinear socket-buffer fragment, and a crafted packet carrying an ARP payload is enough to trigger the out-of-bounds write [10]. Red Hat confirmed that a known exploit exists [12]. Kimmo Suominen has published a technical analysis and a patch-status tracker on GitHub that sketches a privilege-escalation path through modification of file-backed memory, and he notes that the chain is inferred by analogy with Dirty Pipe and has not been demonstrated with public exploit code [22][23].
"This CVE is high risk and there are known public exploits leveraging this vulnerability," Red Hat said in its updated advisories. "Address this vulnerability with high priority." [20]
The window was three calendar days, two of them a weekend, which leaves one business day for any agency that does not run weekend change windows [25]. SecurityWeek described the order as patching all three within three days [5]. BleepingComputer, publishing on the due date, described the deadline as the end of that day [6]. CISA has not described the incidents, the actors, or whether the three were used together in one chain [7].
Separately from the KEV additions, researcher Asim Manizada disclosed four local privilege escalation flaws in the Linux kernel: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject) and CVE-2026-74469 (DiagSpill) [24].
What to watch
- Whether CISA publishes exploitation details or ties any of the three CVEs to a named actor or intrusion set.
- Whether public exploit code appears for the CVE-2026-53266 privilege-escalation chain that Suominen currently infers from Dirty Pipe.
- Whether any of the three picks up a ransomware-use flag in the KEV catalog.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence74
- Adoption68
- Hype gap−8
- Incentives38
- Confidence76
Perspective Coverage
6 publishers- Builder
- Builder 30%
- Operator
- Operator 57%
- Investor
- Investor 13%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
CISA added three Linux kernel security flaws to its Known Exploited Vulnerabilities catalog on Friday, citing evidence of active exploitation.
- [2]
The three vulnerabilities are CVE-2025-39682, CVE-2026-53266 and CVE-2025-39964.
- [3]
CVE-2026-53266 (CVSS 8.8) is an out-of-bounds write in the ebtables Source Network Address Translation ARP rewrite path that could allow a local attacker to trigger unintended system behaviour, denial of service, or local privilege escalation.
- [4]
CISA ordered federal agencies to fix the three vulnerabilities by September 21, 2026.
- [5]
SecurityWeek reported that CISA told federal agencies they should patch all three vulnerabilities within three days.
- [6]
BleepingComputer reported that CISA ordered federal agencies to apply available security updates and mitigations by the end of the day of publication.
- [7]
There are no details on how the three vulnerabilities are being exploited in the wild, or whether they are being used together as part of a single attack chain.
- [8]
CVE-2025-39682 (CVSS 9.8) is an improper check for unusual or exceptional conditions in the Linux kernel TLS receive path that could allow local authenticated users to trigger memory disclosure or denial of service.
- [9]
CVE-2025-39964 (CVSS 7.8) is a race condition allowing concurrent writes to the same AF_ALG socket, letting a local attacker crash the system or corrupt cryptographic operation results.
- [10]
In CVE-2026-53266 an ARP sender hardware address is written directly into a nonlinear socket-buffer fragment, causing memory corruption, and an attacker can trigger the unsafe write with a crafted packet containing an ARP payload.
- [11]
Public exploits are available for CVE-2025-39682, as confirmed by Red Hat in its security bulletin.
- [12]
Red Hat confirmed a known exploit is available for CVE-2026-53266.
- [13]
CISA marked all three flaws as requiring "forensic triage", meaning that for every affected asset federal agencies need to examine it for signs that exploitation already occurred.
- [14]
Issuing two writes to the same AF_ALG socket leads to data being interleaved in an unpredictable fashion, creating inconsistencies in the socket's internal state.
- [15]
CVE-2025-39964 existed in the Linux kernel for 14 years.
- [16]
Offensive security company STAR Labs found CVE-2025-39964 and said its researchers found the issue with no help from an AI system.
- [17]
STAR Labs demonstrated CVE-2025-39964 by achieving privilege escalation and container escape in Google's kernelCTF.
- [18]
Red Hat updated the advisories for all three flaws as of September 19, 2026 at 2 a.m. UTC to acknowledge active exploitation.
- [19]
All three vulnerabilities are described as exploitable by a local attacker or local authenticated user.
- [20]
"This CVE is high risk and there are known public exploits leveraging this vulnerability," Red Hat said. "Address this vulnerability with high priority."
- [21]
None of the three flaws is currently flagged as exploited by ransomware groups.
- [22]
Researcher Kimmo Suominen has published a technical analysis and patch-status tracker for CVE-2026-53266 on GitHub, outlining a potential privilege-escalation path involving modifications to file-backed memory.
- [23]
Suominen notes that the proposed exploitation chain for CVE-2026-53266 is inferred by analogy with Dirty Pipe and has not been demonstrated with public exploit code.
- [24]
Security researcher Asim Manizada disclosed four local privilege escalation flaws in the Linux kernel: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject) and CVE-2026-74469 (DiagSpill).
- [25]
The remediation window ran three calendar days, two of which were a weekend, leaving one business day.
- [26]
The highest-scored of the three flaws (CVSS 9.8) has documented outcomes of memory disclosure and denial of service, while the lowest-scored (CVSS 7.8) has a demonstrated privilege escalation and container escape.
- [27]
Security Affairs attributes the due date to Binding Operational Directive 22-01, under which FCEB agencies have to address catalogued vulnerabilities by the due date.
- [28]
The Hacker News reports that pursuant to Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, FCEB agencies are recommended to apply the necessary fixes by September 21, 2026.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCISA alerts of active exploitation of three Linux kernel flaws
1 article · September 21, 2026
- cisa.govCISA Adds Two Known Exploited Vulnerabilities to Catalog
2 articles · September 18, 2026
- scworld.comCISA adds Linux kernel flaws to exploited vulnerabilities catalog
1 article · September 21, 2026
- securityaffairs.comU.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog
1 article · September 20, 2026
- securityweek.comOrganizations Warned of 3 Exploited Linux Kernel Vulnerabilities
1 article · September 21, 2026
- thehackernews.comCISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild
2 articles · September 19, 2026
Topics and entities
Topics
- Linux kernel and networking security
- Privilege Escalation
- Container Security
- Known Exploited Vulnerabilities catalog
- Federal Cyber Compliance Mandates