CISA Orders Federal Agencies to Patch Three Actively Exploited Linux Kernel Flaws in Three Days

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning about three Linux kernel vulnerabilities that attackers are actively exploiting. On September 18, 2026, CISA added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its Known Exploited Vulnerabilities (KEV) catalog. What makes this addition unusual is the deadline: federal civilian agencies must remediate the flaws by September 21, 2026, giving them only three days. Under normal circumstances, KEV entries allow about three weeks for patching. Cyber Security News reported on September 22 that the three-day window reflects the severity of the threat and the confirmed real-world exploitation.

The three vulnerabilities affect different parts of the Linux kernel and carry severity scores that range from high to critical. CVE-2025-39682 has a CVSS score of 9.8 and resides in the kernel TLS (kTLS) receive path. CVE-2026-53266 scores 8.8 and involves an out-of-bounds write in the netfilter bridge ebtables source network address translation (SNAT) target. CVE-2025-39964 scores 7.8 and is a race condition in the kernel AF_ALG cryptographic interface. Red Hat, whose advisories are cited by multiple outlets, has stated that all three vulnerabilities are being actively exploited and that known public exploit code exists. In each advisory, Red Hat described the CVEs as high risk and urged organizations to handle them with high priority.

TechBriefly reported on September 22 that CISA ordered federal agencies to patch the vulnerabilities or stop using affected products by the September 21 deadline. The report noted that patches for supported kernel versions are already available. However, the remediation challenge is compounded by the fact that CISA has not disclosed who is using the exploits, which systems are being targeted, or how the exploits are being delivered. No independent cyberattack incidents have been publicly linked to these three vulnerabilities. The lack of attribution does not diminish the urgency, because inclusion in the KEV catalog confirms that exploitation has occurred in the wild.

Dataconomy reported on September 22 that the three-day deadline is significantly shorter than the roughly three weeks that federal civilian agencies typically receive for KEV vulnerabilities. The article also placed the event in a broader context, recalling four other Linux local privilege escalation vulnerabilities disclosed earlier in 2026: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121), and DiagSpill (CVE-2026-74469). This pattern suggests that kernel-level security issues remain a persistent concern for defenders.

Key Facts

CISA added the three vulnerabilities to the KEV catalog on September 18, 2026, under the authority of Binding Operational Directive 26-04. The directive requires federal civilian agencies to remediate the flaws by September 21, 2026. In addition to patching, CISA marked all three as requiring forensic triage. That means affected agencies must determine whether their assets have already been compromised, not merely install updates. Cyber Security News reported on September 22 that this forensic requirement adds a layer of investigation that goes beyond routine patching.

CVE-2025-39682 is the most severe of the three at CVSS 9.8. It is an improper-condition check in the Linux kernel TLS receive path. According to the advisories, when the record length taken from the rx_list is zero, the code bypasses the recvmsg() record type handling. Subsequent TLS records are then processed under incorrect zero-copy and queueing assumptions. Red Hat stated that the vulnerability can be triggered remotely when kTLS is enabled and attached to a TCP socket. Internet-exposed services that use kTLS are therefore the highest priority for patching. The fix is available in stable kernel versions 6.1.149, 6.6.103, 6.12.44, and 6.16.4. A temporary mitigation is to block the tls module from loading, but only if kTLS is not needed.

CVE-2026-53266 carries a CVSS score of 8.8 and is an out-of-bounds write in the netfilter bridge ebtables SNAT target. During an optional ARP sender hardware address rewrite, the kernel may call skb_store_bits() without confirming that the target range is writable. If the data resides in a non-linear socket buffer fragment backed by a file page imported by splice, the write can go directly to the underlying page. Red Hat warned that a local attacker could exploit this to cause memory corruption, a denial of service, or even privilege escalation. Patches have been applied upstream and backported to supported branches, including 5.10.259, 6.1.176, and 6.12.94. Mitigations include disabling ARP hardware address rewriting in ebtables SNAT rules, or removing ebtables SNAT rules that act on ARP traffic on bridge interfaces.

CVE-2025-39964 is a race condition in the kernel AF_ALG cryptographic interface, with a CVSS score of 7.8. It is a local, low-privilege path that impacts confidentiality, integrity, and availability at a high level. Concurrent writes to the same AF_ALG socket can interleave unpredictably, leading to inconsistent internal state. A local attacker could crash the system or corrupt cryptographic operations, causing data integrity problems and a possible denial of service. The fix introduces exclusive write ownership, ensuring that only one writer can use sendmsg() at a time. Patched versions include 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, and 6.16.9. Unlike the other two vulnerabilities, there is no viable mitigation apart from applying the patch.

TechBriefly reported on September 22 that Red Hat described each of the three CVEs as high risk and noted the existence of known public exploit code. The report also stated that CISA has not revealed any details about the attackers, the victims, or the exploitation techniques. Whether ransomware groups are involved remains unknown. For administrators, CISA recommends installing vendor-provided kernel updates and rebooting into the fixed kernel, then verifying the running version. Because generic version numbers can be misleading, agencies should rely on distribution-specific kernel packages rather than upstream version labels alone.

Analysis

The shortened three-day deadline is the most telling aspect of this event. KEV entries normally give federal civilian agencies about three weeks to patch, but CISA compressed that window to 72 hours for these three Linux kernel flaws. What this really means is that CISA believes the risk of waiting is unacceptable, likely because the vulnerabilities are remotely exploitable, public exploit code exists, and at least one of them (CVE-2025-39682) can be triggered over the network against kTLS-enabled services. For agencies with internet-facing Linux systems, the time to act was effectively immediate.

The forensic triage requirement adds another layer of difficulty. Patching closes the door, but it does not tell an agency whether an attacker already came through. Security teams must examine kernel crash logs, look for unusual privilege changes, monitor for abnormal namespace activity, and check for unauthorized netfilter modifications. Cyber Security News reported on September 22 that agencies should preserve telemetry data before remediation, because rebooting into a patched kernel can destroy volatile evidence. This investigative burden is substantial, especially for smaller agencies that may lack dedicated incident response staff.

The mix of remote and local attack vectors complicates prioritization. CVE-2025-39682 is remotely triggerable and therefore the most urgent for exposed services. CVE-2026-53266 and CVE-2025-39964 require local access, but local access is often the first step in a multi-stage intrusion. An attacker who gains a low-privilege foothold through a different vulnerability could use these flaws to escalate privileges, crash systems, or tamper with cryptographic operations. The fact that CVE-2025-39964 has no mitigation other than patching means that agencies cannot buy time with configuration changes. They must update and reboot.

Dataconomy reported on September 22 that these three flaws follow four other Linux local privilege escalation vulnerabilities disclosed earlier in 2026. The bigger picture here is that Linux kernel security is under sustained pressure. While no single flaw may be catastrophic on its own, the cumulative effect of repeated kernel vulnerabilities forces defenders to maintain rapid patching cycles, strong asset inventory, and continuous monitoring. The three-day deadline is a stress test of those capabilities.

Why It Matters

Linux powers a vast portion of federal infrastructure, cloud services, and embedded systems, so kernel vulnerabilities can have broad reach. The three flaws affect core networking and cryptographic subsystems: TLS handling, netfilter bridging, and AF_ALG. These are not obscure components. An attacker who can exploit the kTLS receive path remotely could potentially leak memory or cause a denial of service on exposed servers. Local attackers who exploit the ebtables or AF_ALG flaws could escalate privileges or corrupt sensitive cryptographic operations. The combination of remote and local vectors makes these vulnerabilities relevant to a wide range of deployments.

The unusual 72-hour deadline also signals how seriously CISA views the threat. Federal agencies that fail to meet the September 21 deadline could face compliance consequences under Binding Operational Directive 26-04. More importantly, they could remain exposed to active exploitation. TechBriefly reported on September 22 that Red Hat considers all three CVEs high risk with public exploit code, which lowers the barrier for attackers. Even organizations outside the federal government should treat this as a wake-up call, because the same Linux kernels run in commercial environments, and attackers do not discriminate based on sector.

Finally, the event highlights the importance of forensic readiness. Patching is necessary but not sufficient if an intrusion has already occurred. The requirement to perform forensic triage means that agencies must be able to detect compromise, not just prevent it. That requires logging, monitoring, and the ability to analyze kernel-level anomalies. For many organizations, this is a gap that needs closing. The three-day window may be over by the time this article is published, but the lessons about speed, visibility, and preparedness will endure.

Next Up

With the September 21 deadline now passed, federal civilian agencies are expected to have patched the three vulnerabilities or stopped using affected products. However, CISA may continue to monitor for additional exploitation and could add more Linux kernel flaws to the KEV catalog if new threats emerge. Security teams should also watch for follow-up advisories from Red Hat and other Linux distributors, as well as updates to the National Vulnerability Database (NVD) entries for CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964. The NVD is likely to refine its analysis as more information becomes available.

Organizations that have not yet completed remediation should act immediately. They should verify that their running kernel includes the fixes, reboot if necessary, and conduct the forensic triage that CISA requires. Even after patching, continued monitoring for kernel crashes, unauthorized netfilter changes, and abnormal privilege changes is prudent. Given the pattern of Linux kernel vulnerabilities in 2026, including the earlier DirtyAH6, TUNderflow, PPPoEject, and DiagSpill flaws, defenders should expect more kernel security challenges in the months ahead.