The **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** has escalated its warnings regarding **Linux kernel** security, adding three critical flaws to its **Known Exploited Vulnerabilities (KEV)** catalog. This action, taken on Friday, indicates active exploitation of these vulnerabilities, posing significant risks to systems running the open-source operating system. ### The Exploited Vulnerabilities The three vulnerabilities now listed in CISA's KEV catalog are: * **CVE-2025-39682** (CVSS score: 9.8): An improper check for unusual or exceptional conditions in the TLS receive path. This flaw could enable local authenticated users to trigger memory disclosure or a denial-of-service (DoS) condition. * **CVE-2026-53266** (CVSS score: 8.8): An out-of-bounds write vulnerability within the **ebtables** Source Network Address Translation (SNAT) Address Resolution Protocol (ARP) rewrite path. A local attacker could leverage this to cause unintended system behavior, DoS, or achieve local privilege escalation. * **CVE-2025-39964** (CVSS score: 7.8): A race condition vulnerability allowing concurrent writes to the same **AF_ALG** socket. This could lead to system crashes or corruption of cryptographic operation results, resulting in DoS or data integrity issues. ### Urgent Patching Mandate While specific details regarding the in-the-wild exploitation of these vulnerabilities remain undisclosed, **Red Hat** has updated its advisories for all three flaws as of September 19, 2026, confirming active exploitation. Red Hat emphasized the high risk associated with **CVE-2025-39682**, stating, "This CVE is high risk and there are known public exploits leveraging this vulnerability. Address this vulnerability with high priority." In response to this threat, **CISA** has issued a directive under **Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk**. This mandates **Federal Civilian Executive Branch (FCEB)** agencies to apply the necessary fixes for these vulnerabilities by September 21, 2026. ### Broader Linux Kernel Concerns This announcement follows closely on the heels of disclosures by security researcher **Asim Manizada**, who recently revealed four additional local privilege escalation flaws impacting the Linux kernel. These include **CVE-2026-80844** (aka **DirtyAH6**), **CVE-2026-81000** (aka **TUNderflow**), **CVE-2026-68121** (aka **PPPoEject**), and **CVE-2026-74469** (aka **DiagSpill**). The cumulative effect of these disclosures underscores a critical period for Linux system administrators, highlighting the ongoing need for vigilant patching and robust security practices.