CISA orders emergency patching for three actively exploited Linux kernel flaws

CISA added three actively exploited Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalogue on 21 September, ordering federal civilian agencies to patch or mitigate them within three days². The most severe, CVE-2025-39682 (CVSS 9.8), is a flaw in the kernel's TLS receive path that can be abused for denial of service or memory disclosure, and public exploit code already exists for it¹². CVE-2026-53266 (CVSS 8.8) is an out of bounds write in the kernel's bridge Netfilter ebtables SNAT target, triggered by a crafted packet carrying an ARP payload¹². CVE-2025-39964 (CVSS 7.8) is a 14 year old race condition in the kernel's AF_ALG cryptographic socket interface, found by offensive security firm STAR Labs, which said it located the bug with no help from an AI system¹.

CISA has not disclosed who is exploiting the flaws, and none of the three is currently linked to ransomware activity¹. Red Hat's own security bulletins confirm exploitation exists for both CVE-2025-39682 and CVE-2026-53266². CISA has also directed agencies to run forensic triage on affected systems to check for prior exploitation¹.

Why it matters: All three flaws sit in code every Linux server and container runs, and CISA's own three day deadline signals it sees live exploitation, not just theoretical risk.