As reported by CISA on September 18, 2026, two Linux kernel vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation in the wild. CVE-2025-39964, a race condition vulnerability, and CVE-2026-53266, an out-of-bounds write vulnerability, both affect the Linux kernel — the core of virtually every modern server, container, and cloud workload infrastructure.

Security Impact: As reported by CISA on September 18, 2026, two Linux kernel vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) Catalog based on confirmed evidence of active exploitation in the wild.

What makes this KEV addition particularly significant is the target: the Linux kernel. Unlike application-layer CVEs that might affect a single service or product, kernel vulnerabilities can grant attackers fundamental control over the entire operating system. A race condition exploited at the kernel level can bypass locking mechanisms and privilege boundaries, while an out-of-bounds write can corrupt kernel memory to achieve arbitrary code execution with ring-0 privileges. Once you have kernel-level access, persistence, container escapes, and hypervisor interaction all become feasible attack paths.

Why Kernel KEV Entries Demand Urgent Attention

The KEV catalog is not a theoretical risk register — it is CISA's triage list of vulnerabilities that threat actors are already using. When kernel-level flaws appear here, the implications cascade across infrastructure:

  • Cloud and container environments are especially exposed. A kernel exploit on a host can compromise every container running on that node, undermining tenant isolation.
  • Edge and IoT deployments running embedded Linux often lack automated patching pipelines and may remain vulnerable for months.
  • Legacy server fleets running older LTS kernels may not yet have backported fixes available from their distribution vendor.
The combination of a race condition and an out-of-bounds write in the same KEV update suggests attackers may be chaining memory corruption primitives — a pattern consistent with sophisticated exploitation toolkits.

Vulnerability Summary

CVETypeComponentExploitation StatusSeverity
CVE-2025-39964Race ConditionLinux KernelActive in the wildHigh / Critical (pending NVD confirmation)
CVE-2026-53266Out-of-Bounds WriteLinux KernelActive in the wildHigh / Critical (pending NVD confirmation)
Note: Specific CVSS scores, affected kernel versions, and patch availability should be confirmed via the NVD entries and your distribution's security tracker. CISA's KEV listing confirms exploitation but does not always include full technical metadata in the alert itself.

Who Is Most at Risk

  • Organizations with internet-exposed Linux hosts — especially SSH-accessible servers, VPN gateways, and reverse proxies
  • Container orchestration platforms (Kubernetes, Nomad) where a single kernel compromise affects all pods on a node
  • Federal agencies subject to BOD 26-04, which now requires not just patching but also compromise checking prior to remediation
  • Managed service providers whose multi-tenant Linux infrastructure amplifies blast radius

Shield53 Recommendations — Immediate Actions

  1. Inventory kernel versions across all Linux assets immediately. Include bare-metal servers, VMs, containers, and network appliances running embedded Linux. You cannot patch what you have not enumerated.
  2. Check distribution security trackers for your specific distro (Ubuntu USN, RHEL RHSA, Debian DSA, SUSE) for patched kernel packages addressing both CVEs. Kernel updates typically require a reboot — plan maintenance windows accordingly.
  3. Prioritize internet-exposed systems first. If patching cannot occur immediately, restrict external access via network segmentation, firewall rules, or WAF policies. For SSH exposure, enforce key-based auth and IP allowlisting as a stopgap.
  4. Hunt for compromise before patching. Per BOD 26-04 guidance, check for signs of post-exploitation: unexpected kernel modules (lsmod), hidden processes, modified system binaries, suspicious cron jobs, and unauthorized SSH keys. Kernel exploits often deploy rootkits — use memory-based detection tools where possible.
  5. Monitor for exploitation indicators. Enable kernel auditing (auditd), review dmesg for kernel panics or oops messages that may indicate failed exploitation attempts, and deploy EDR with kernel-level visibility.
  6. Subscribe to KEV updates programmatically. The KEV catalog is available as a JSON feed. Integrate it into your vulnerability management platform so future additions trigger automated ticketing workflows.

The broader takeaway: kernel vulnerabilities are no longer rare events that defenders can defer to the next maintenance window. CISA's decision to add both of these to the KEV — alongside the updated BOD 26-04 framework requiring compromise detection — reflects a shifting posture where kernel memory corruption is treated as an imminent, active threat. Every organization running Linux infrastructure, not just federal agencies, should be treating KEV additions as patch-or-contain emergencies.