Three Linux Kernel Flaws Are Being Exploited Now — Patch by Monday
Three Linux Kernel Flaws Are Being Exploited Now — Patch by Monday
Section titled “Three Linux Kernel Flaws Are Being Exploited Now — Patch by Monday”CISA added three Linux kernel flaws to its Known Exploited Vulnerabilities catalog on September 18, 2026 (CISA KEV, 2026). All three are under active exploitation (The Hacker News, 2026). Federal civilian agencies must remediate by September 21 under Binding Operational Directive 26-04 (TechTimes, 2026). The deadline applies to the whole industry in practice. These are kernel bugs with public exploits, and they sit under nearly every Linux workload you run.
The three flaws
Section titled “The three flaws”| CVE | CVSS | Subsystem | What it does |
|---|---|---|---|
| CVE-2025-39682 | 9.8 | kTLS receive path | Zero-length record bypasses record-type handling, corrupting TLS processing (CyberSecurityNews, 2026) |
| CVE-2026-53266 | 8.8 | ebtables SNAT | Out-of-bounds write in packet filtering, local privilege escalation (SecurityOnline, 2026) |
| CVE-2025-39964 | 7.8 | AF_ALG | Race condition corrupts crypto results or crashes the system (CyberSecurityNews, 2026) |
Red Hat updated its advisories for all three on September 19, 2026 and acknowledged active exploitation. It rated them high risk with known public exploits and told customers to patch with high priority (The Hacker News, 2026; Red Hat, 2026).
CVE-2025-39682: the critical kTLS bug
Section titled “CVE-2025-39682: the critical kTLS bug”CVE-2025-39682 is a critical improper-condition check in the kernel’s software TLS receive path (CyberSecurityNews, 2026). Software TLS lives in net/tls/tls_sw.c. An application enables it by setting TCP_ULP to "tls" on a TCP socket (TechTimes, 2026).
The flaw is a corner case. A zero-length record pulled from the receive list bypasses the normal record-type handling in recvmsg(). Later TLS records then get processed with wrong zero-copy and queueing assumptions (CyberSecurityNews, 2026).
The exposure window is wide. A public proof-of-concept has circulated since September 2025, so vulnerable hosts may have faced exploitation attempts for up to a year before the KEV addition (TechTimes, 2026). Affected versions span Linux 6.0 through 6.16.3, plus release candidates 6.17-rc1 and 6.17-rc2 (TechTimes, 2026).
The fix is a code change in tls_sw_recvmsg() that handles the zero-length record case. There is no configuration-only workaround. Disabling kTLS entirely is the only mitigation short of patching (TechTimes, 2026).
CVE-2026-53266: out-of-bounds write in ebtables
Section titled “CVE-2026-53266: out-of-bounds write in ebtables”CVE-2026-53266 is a high-severity out-of-bounds write in the netfilter bridge ebtables SNAT target (CyberSecurityNews, 2026). It lets a local attacker escalate to root (SecurityOnline, 2026).
The bug sits in the Address Resolution Protocol rewrite path. During an optional sender hardware-address rewrite, the kernel can call skb_store_bits() without confirming the destination range is writable. If the data lives in a nonlinear socket-buffer fragment backed by a splice-imported file page, the write lands directly in the underlying page (CyberSecurityNews, 2026).
The upstream fix adds skb_ensure_writable() to the ebt_snat path, forcing the buffer to be writable before the copy (TechTimes, 2026).
CVE-2025-39964: the AF_ALG race
Section titled “CVE-2025-39964: the AF_ALG race”CVE-2025-39964 is a race condition in AF_ALG, the kernel interface that exposes cryptographic operations to userspace through socket file descriptors (TechTimes, 2026). The data path allowed two concurrent writers on the same socket. Request payloads from separate threads interleave unpredictably inside the kernel’s crypto processing queue, leaving the per-socket context inconsistent (SecurityOnline, 2026). The result is corrupted cryptographic output or a denial of service (CyberSecurityNews, 2026).
The fix adds exclusive write ownership. Only one writer may call sendmsg() on the socket at a time (CyberSecurityNews, 2026).
Watch the scope, not just the score. The flaw carries a CVSS of 7.8, but it affects kernels from 2.6.38 through 6.16.9 and 6.17-rc6. That is a much older and broader exposure surface than the score suggests (TechTimes, 2026).
Patch, reboot, then triage
Section titled “Patch, reboot, then triage”All three fixes require a kernel update followed by a system reboot. None of them has a configuration-only fix (TechTimes, 2026). Plan the reboot window now, because the calendar is short.
BOD 26-04 adds a step the old directive never required. Agencies must determine whether a system was already compromised before the patch arrived. Forensic triage is now part of the remediation, not an afterthought (TechTimes, 2026).
CISA has not published how the three flaws are being exploited in the wild, or whether they form a single attack chain (The Hacker News, 2026). Treat that gap as a reason to move faster, not slower.
Your checklist
Section titled “Your checklist”- Inventory kernel versions. Run
uname -ron every fleet, then compare against the affected ranges for each CVE (TechTimes, 2026). Legacy distro kernels are the most likely to miss the fixes. - Apply vendor updates. CISA directs affected organizations to apply vendor mitigations under BOD 26-04 (CyberSecurityNews, 2026). Red Hat, Canonical, SUSE, and Debian each shipped or are shipping kernel errata.
- Reboot after the update. No fix takes effect without a reboot. Schedule rolling reboots so no workload stays on a vulnerable kernel past September 21 (TechTimes, 2026).
- Prioritize kTLS hosts. CVE-2025-39682 is the critical one, and its proof-of-concept is a year old. Multi-tenant hosts and anything that terminates TLS in-kernel get patched first (TechTimes, 2026).
- Run forensic triage on exposed hosts. Even patched hosts that were previously exposed may have been compromised before the fix. Review kernel logs and check for persistence before you call the ticket closed (TechTimes, 2026).
The takeaway
Section titled “The takeaway”The KEV catalog is a list of bugs that attackers already use. Three of those bugs are in the Linux kernel, one of them is a year old, and the federal deadline is tomorrow (CISA KEV, 2026; TechTimes, 2026). Kernel patching is rarely urgent, and that is exactly why this batch matters. Inventory, update, reboot, and triage this weekend, not next sprint.