As reported by SecurityAffairs, CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, triggering mandatory remediation for federal agencies and strong advisory action for private-sector organizations. The inclusion of CVE-2025-39682, CVE-2025-39964, and CVE-2026-53266 confirms that these flaws are no longer theoretical — they are being exploited in the wild.
What makes this KEV update particularly notable is the diversity of the affected subsystems. These are not three variants of the same bug; they target distinct kernel paths — TLS receive handling, ebtables NAT rewriting, and AF_ALG cryptographic sockets — which suggests attackers may be chaining them or selecting based on target configuration. The kernel's ubiquity across cloud infrastructure, embedded systems, and enterprise servers amplifies the blast radius considerably.
Vulnerability Summary
| CVE ID | CVSS | Subsystem | Impact |
|---|---|---|---|
| CVE-2025-39682 | 9.8 Critical | TLS receive path | Sensitive memory disclosure or DoS; authenticated local user |
| CVE-2026-53266 | 8.8 High | ebtables SNAT ARP rewrite | Memory corruption → crash or privilege escalation |
| CVE-2025-39964 | 7.8 High | AF_ALG sockets (crypto) | Race condition → crash or cryptographic integrity compromise |
Why This Matters Beyond the KEV Deadline
The September 21, 2026 remediation deadline under BOD 22-01 applies formally to FCEB agencies, but the private sector should treat KEV inclusion as a leading indicator of broader exploitation. Attackers reverse-engineer KEV entries rapidly — once a flaw is publicly cataloged as exploited, commodity threat groups often integrate working exploits into toolkits within days.
The TLS receive-path flaw (CVE-2025-39682) is especially concerning for organizations running kernel TLS offload configurations, increasingly common in high-throughput web servers and load balancers. The AF_ALG race condition (CVE-2025-39964) has subtler but equally dangerous implications: corruption of cryptographic operations could undermine the integrity of encryption services without obvious system instability, making detection significantly harder.
KEV catalog inclusion is not a warning — it is confirmation. By the time a vulnerability reaches this list, exploitation is already occurring. Defenders who wait for public exploit code are already behind.
Who Is Most Exposed
- Cloud and hosting providers running custom or older kernel branches that lag mainline stable releases
- Container platforms where host kernel vulnerabilities can be triggered from within unprivileged containers
- Network appliance vendors leveraging Linux-based firewalling (ebtables/netfilter) in embedded firmware
- Organizations with long-lived bare-metal servers that patch infrequently or rely on extended LTS kernels without timely backports
Shield53 Recommendations
Immediate Actions
- Patch now. Identify all Linux hosts and appliances, determine kernel versions, and apply vendor-provided patches or upgraded kernel packages. Prioritize CVE-2025-39682 (CVSS 9.8) first.
- Audit kernel TLS usage. If kTLS is enabled on any production server, verify whether the patched kernel is deployed. Consider disabling kTLS offload as a temporary mitigation if immediate patching is not feasible.
- Restrict local access. All three flaws require local access. Enforce least-privilege user management, audit shell access, and review container escape surfaces where untrusted users share a kernel.
- Deploy detection rules. Monitor for anomalous ebtable rule modifications, unexpected AF_ALG socket creation patterns, and TLS-related kernel warnings in dmesg/journalctl. Look for privilege escalation attempts following kernel panics or OOM events on affected hosts.
- Inventory appliance firmware. Contact network appliance vendors for updated firmware that incorporates patched kernels. Embedded Linux devices are frequently the last to receive kernel updates and represent persistent blind spots.
- Subscribe to KEV updates. Automate ingestion of the CISA KEV catalog into your vulnerability management pipeline so future additions trigger immediate ticketing and prioritization.
The Linux kernel remains the foundation of modern infrastructure, and its attack surface continues to yield high-impact vulnerabilities. Organizations that treat kernel patching as a routine hygiene task rather than an emergency response capability will consistently find themselves on the wrong side of KEV deadlines. Build the muscle now — the next batch is inevitable.
