The Cybersecurity and Infrastructure Security Agency (CISA) added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in September 2026. The KEV catalog lists flaws with evidence of real-world attacks (Cybersecurity and Infrastructure Security Agency, n.d.).

The three flaws

• CVE-2025-39682 (CVSS 9.8): a TLS receive path flaw leading to memory disclosure or denial of service.
• CVE-2026-53266 (CVSS 8.8): an out-of-bounds write in ebtables, allowing local privilege escalation or crashes.
• CVE-2025-39964 (CVSS 7.8): a race condition in AF_ALG sockets, which crashes systems or corrupts cryptographic results.

Red Hat confirmed public exploits for the flaws. CISA set a September 21, 2026, patch deadline for federal agencies (The Hacker News, 2026).

Who should act

Linux runs web servers, cloud systems, and many network storage devices. Run Linux at home or at work? Install the latest kernel updates from your distribution and restart.