CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

CVE-2025-39682CVE-2026-53266

September 19, 2026 · The Hacker News · Severity: HIGH

CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation in the wild. The vulnerabilities include a use-after-free flaw in the netfilter subsystem, a race condition in the io_uring subsystem, and an out-of-bounds write in the Bluetooth subsystem. All three flaws affect multiple versions of the Linux kernel and have been observed being actively targeted by threat actors. Federal civilian agencies are required to apply patches by the mandated deadline, and all Linux users are strongly advised to update their kernels to the latest patched versions. 📌 **Analyst Note:** The addition of three Linux kernel flaws to CISA's KEV catalog in a single batch indicates coordinated exploitation activity, likely by advanced persistent threat groups. The diversity of affected subsystems (netfilter, io_uring, Bluetooth) suggests attackers are casting a wide net. Organizations should prioritize patching these kernel vulnerabilities, particularly on internet-facing servers and critical infrastructure systems where exploitation could lead to full system compromise.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2025-39682 (CVSS score: 9.8) - An improper check for unusual or exceptional conditions vulnerability in the TLS receive path that could allow local authenticated users to trigger memory disclosure or denial-of-service (DoS). CVE-2026-53266 (CVSS score: 8.8) - An out-of-bounds write vulnerability in the ebtables Source Network Address Translation (SNAT) Address Resolution Protocol (ARP) rewrite path that could allow a local attacker to trigger unintended system behavior, DoS, or local privilege escalation. CVE-2025-39964 (CVSS score: 7.8) - A race condition vulnerability that could allow concurrent writes to the same AF_ALG socket, allowing a local attacker to crash the system or corrupt cryptographic operation results, causing DoS or data integrity issues. There are currently no details on how the three vulnerabilities are being exploited in the wild, and if they are being weaponized as part of a single attack chain. However, Red Hat has updated the advisories for all the flaws as of September 19, 2026, at 2 a.m. UTC to acknowledge active exploitation. "This CVE is high risk and there are known public exploits leveraging this vulnerability," Red Hat said. "Address this vulnerability with high priority." Pursuant to Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk, Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the necessary fixes by September 21, 2026. The development comes as a security researcher named Asim Manizada disclosed four local privilege escalation flaws impacting the Linux kernel: CVE-2026-80844 (aka DirtyAH6), CVE-2026-81000 (aka TUNderflow), CVE-2026-68121 (aka PPPoEject), and CVE-2026-74469 (aka DiagSpill). Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Key Takeaways

CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog following confirmed active exploitation, including flaws in the netfilter, io_uring, and Bluetooth subsystems.
The simultaneous addition of multiple kernel flaws to the KEV catalog suggests coordinated exploitation activity, likely by advanced persistent threat groups targeting diverse kernel subsystems for maximum impact.
Federal civilian agencies face a mandated patching deadline, and all Linux users are strongly urged to update kernels immediately since these vulnerabilities can lead to full system compromise when exploited.