Linux’s new KEV trio gets a 9.8 score — Red Hat rates it 7.9

CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, with a patch deadline for federal civilian agencies that expired on September 21, 2026. The agency added all three entries on September 18 and required affected agencies either to apply updates and available mitigations or stop using the affected products.

The three-day window signals urgency. The vulnerabilities—CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964—are all patched upstream, but CISA says exploitation has occurred and requires agencies to conduct forensic triage on every affected asset. Patching alone is therefore not considered sufficient for systems that could already have been compromised.

The three flaws have different exposure models. CVE-2025-39682 affects the kernel TLS receive path and can be triggered over a network, but only where the kTLS User-Level Protocol is enabled and attached to TCP sockets. The other two require local access, making them more relevant as privilege-escalation or post-compromise paths than as initial remote-entry bugs.

Recommended reading

Gemini hit three companies through one test flaw, not three exploits

Sergey Kuznetsov • Sep 19, 2026 • 9 min read

Administrators should not treat that version list as a substitute for checking their distribution’s advisory and installed kernel package. Distributions can backport fixes without adopting a listed upstream version number, while systems on custom kernels may need to verify the relevant commits or vendor patches directly.

The remotely reachable kTLS bug has conflicting severity scores

CVE-2025-39682 is the outlier because its affected code can be reached remotely under a specific configuration. The defect is in kTLS’s receive path, which lets applications offload TLS record handling into the kernel. A recvmsg() call is supposed to process either contiguous DATA records or one non-DATA record; if the record type changes, processing should stop.

The bug arises when the initial record is a zero-length record retrieved from rx_list. In that case, the receive code could fail to enforce the per-call record-type constraint, allowing a mixed record-type sequence to proceed into data processing. The Red Hat vulnerability record describes the fixed logic: it initializes the per-call content type with 0 as an unset value and exits when a non-DATA record follows DATA.

The severity headline needs qualification. The 9.8 score cited for CVE-2025-39682 is the NVD and CVE.org CVSS v3.1 score, using a network attack vector, low complexity, no privileges, and high confidentiality, integrity, and availability impacts. Red Hat assigns the same flaw 7.9, with a network attack vector but high attack complexity and low—not high—confidentiality and integrity impact. Both scorecards agree on a high availability impact.

This is not a clerical discrepancy. A 9.8 rating implies a broadly critical remote risk in generic conditions; Red Hat’s 7.9 assessment reflects the prerequisite that kTLS must be enabled and used on relevant TCP sockets, plus the complexity of constructing a viable trigger. Neither score removes the need to patch, particularly after CISA’s exploited designation, but the difference matters for teams prioritizing vulnerable services by deployment conditions rather than a single database score.

The scope is narrower than “every TLS-enabled Linux server.” The affected path requires CONFIG_TLS and the TLS ULP attached through SOL_TLS. Systems that do not use kernel TLS are not exposed through this particular path. For exposed systems, a temporary mitigation is available: prevent the tls module from loading. That can reduce exposure while a maintenance window is arranged, although it may also disrupt workloads that depend on kTLS.

Two local flaws target networking and cryptographic paths

CVE-2026-53266 affects the bridge/netfilter ebtables implementation, specifically Source NAT rules that rewrite ARP hardware addresses. The vulnerable path can modify a packet range backed by file memory without first making that range writable. The result is an out-of-bounds write condition that can support denial of service or local privilege escalation.

Its practical exposure is conditional. The relevant configuration uses ebtables SNAT rules operating on ARP traffic on bridge interfaces. Operators can reduce risk before patching by disabling ARP hardware-address rewriting in those rules or removing the ebtables SNAT rules that process ARP traffic. Those mitigations are configuration changes, not repairs; systems that need this behavior still need a corrected kernel.

Reporting around CVE-2026-53266 distinguishes between a known exploit and a fully disclosed public chain. Red Hat has said a known exploit exists. Separately, researcher Kimmo Suominen’s analysis describes a potential escalation route involving file-backed memory, inferred by analogy with Dirty Pipe. That proposed chain has not been demonstrated with public exploit code. The absence of public code does not mean the bug is unexploitable; it means defenders should not mistake a plausible technical analysis for a public proof of the complete exploit path.

CVE-2025-39964 has no identified working mitigation. It is a race condition in AF_ALG, Linux’s socket interface for cryptographic operations. Concurrent writes to the same socket can corrupt per-socket state, crash a system, or alter cryptographic-operation results. The issue reportedly existed in the kernel for 14 years before its discovery, and STAR Labs demonstrated privilege escalation and a container escape in Google’s kernelCTF environment.

Unlike the other two flaws, no working mitigation has been identified for CVE-2025-39964. It is a local bug, so an attacker needs a foothold first, which makes it dangerous in shared systems, container environments, or endpoints where untrusted code can execute. For that flaw, updating the kernel is the available defense.

What CISA’s triage requirement changes

CISA’s KEV catalog is a remediation priority list, not a complete technical exploit report. The agency has not disclosed the actors, targets, intrusion paths, or campaigns behind the three exploitation determinations. There are also no identified ransomware groups associated with these CVEs in the available reporting.

CISA’s instruction to perform forensic triage changes the expected response for federal agencies. They must look for evidence that exploitation occurred on each affected asset, rather than merely install an updated package and close the ticket. The reporting does not specify the indicators CISA expects agencies to use, so incident-response teams need to map their own telemetry to the affected paths: kTLS activity and unexpected network failures for CVE-2025-39682; bridge, ebtables, and ARP-rewrite configuration for CVE-2026-53266; and suspicious local processes, crashes, or integrity anomalies around AF_ALG consumers for CVE-2025-39964.

Red Hat’s advisories characterize each issue as high risk and say public or known exploits are available.

“This CVE is high risk and there are known public exploits leveraging this vulnerability. Address this vulnerability with high priority.”

That language should be read alongside the technical constraints. CVE-2025-39682 is potentially remote but kTLS-specific. CVE-2026-53266 depends on a particular bridge and ebtables rule path. CVE-2025-39964 is local but has neither a configuration-based workaround nor a merely theoretical impact demonstration.

Linux endpoint exposure is growing, but the affected population is unclear

The patch urgency arrives as desktop Linux use has become more visible in North America. We reported on August 5 that Linux desktop share reached 10.65% in the region, driven in part by Windows 11 hardware limits and user frustration. That figure does not establish how many systems run an affected kernel or enable the features involved here, but it makes blanket assumptions that Linux is a niche endpoint platform less useful for security planning.

For enterprise teams, the immediate task is inventory rather than panic: identify the running kernel, establish whether vendor backports contain the fixes, determine whether kTLS or bridge ebtables ARP rewriting is deployed, and prioritize any system where untrusted local code can execute. The three bugs share a KEV entry date and deadline, but their attack surfaces are materially different.

CISA and Red Hat confirm exploitation, yet neither identifies a campaign or publishes indicators tied to the three flaws. The available reporting supports a remediation posture, not an attributable threat narrative. The September 21 deadline has passed; any federal system still on a vulnerable kernel is now beyond CISA’s mandated remediation date.

×