The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after observing active exploitation in the wild. Red Hat updated its advisories for all three flaws on September 19, flagging each as “high risk” with known public exploits. Federal Civilian Executive Branch agencies are required to apply patches by September 21, 2026.
The three flaws cover different parts of the kernel: CVE-2025-39682 (CVSS 9.8) is an improper-condition-check in the TLS receive path that can allow a local authenticated attacker to escalate privileges; CVE-2026-53266 (CVSS 8.8) is an out-of-bounds write in the ebtables SNAT ARP handling that can lead to data disclosure or denial of service; and CVE-2025-39964 (CVSS 7.8) is a race condition in the AF_ALG socket interface that a local attacker can use to crash the system or escalate privileges. CISA has not published details on how the flaws are being chained or who is exploiting them. Separately, security researcher Asim Manizada disclosed four additional local privilege escalation flaws — CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), and CVE-2026-74469 (DiagSpill) — that are not yet in the KEV catalog but may affect the same kernel versions.
How to check if you’re affected
Affected products include any system running the Linux kernel versions before the patches released in September 2026 for CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964. Run uname -r to check your kernel version, and compare it against your distribution’s security advisory. For Red Hat, CentOS, Fedora, and RHEL-based systems, run dnf updateinfo list security to see if patches are available. For Debian and Ubuntu, use apt-get update && apt-cache policy linux-image-generic and apply any pending kernel updates. A reboot is required after patching.