CISA has added three Linux kernel vulnerabilities with evidence of real-world exploitation to its Known Exploited Vulnerabilities catalog. All three entries are dated September 18, 2026, carry a September 21 remediation date and flag forensic triage as required. The practical complication is that their patch status differs: some distribution branches already contain fixes, while others still list work in progress. [1]
For Linux desktop owners, developers and server operators, the immediate job is to check the exact kernel package against the distribution’s advisory. “Linux is up to date” is too broad a conclusion when different kernel tracks have different fixes.
Three bugs, three different kernel paths
The catalog groups the vulnerabilities by exploitation evidence, not by a single attack technique. Their underlying failures occur in different parts of the kernel:
- CVE-2025-39682 — kernel TLS record handling. A zero-length record can take a path that violates the rules for separating data records from other TLS records. The fix addresses the interaction between queued records and zero-copy processing, where data is decrypted directly into a userspace buffer. This is a kernel TLS issue; the entry does not establish that every HTTPS service is vulnerable. [2]
- CVE-2025-39964 — competing writes to a cryptographic socket. Two writers using the same AF_ALG socket can interleave data unpredictably and leave its internal state inconsistent. The upstream change enforces exclusive ownership while writing. AF_ALG is an interface to the kernel’s cryptographic services, not a claim that a cryptographic algorithm has been broken. [3]
- CVE-2026-53266 — an address rewrite reaches file-backed memory. The ebtables SNAT code can rewrite an ARP sender’s hardware address without first making that part of the packet buffer writable. When a buffer fragment is backed by a file page imported through splice, the write can reach that page. The missing check matters because a routine packet rewrite crosses a memory boundary it should respect. [4]
CISA’s entries do not identify victims, name an attacker or describe one campaign combining all three bugs. Their ransomware-use fields say “Unknown.” Confirmed exploitation justifies urgency; it does not supply the missing attack history.
Ubuntu’s tables show why one version number is not enough
Canonical’s advisories, checked on September 20, illustrate the difference. The following examples apply specifically to the linux package track shown in each advisory—not every hardware-enablement, cloud or vendor kernel:
- CVE-2025-39682: Ubuntu 24.04 LTS: fixed in
6.8.0-86.87. Ubuntu 22.04 LTS: not affected on this package track. - CVE-2025-39964: Ubuntu 24.04 LTS: fixed in
6.8.0-90.91. Ubuntu 22.04 LTS: fixed in5.15.0-164.174. - CVE-2026-53266: Ubuntu 26.04 LTS: fixed in
7.0.0-31.31. Ubuntu 24.04 and 22.04 LTS: listed as vulnerable, with work in progress.
These are advisory fix versions, not instructions to downgrade or install a kernel from another Ubuntu release. Check the current advisory for your release and package flavor. If a fix is still pending, follow your distribution or appliance vendor’s supported mitigation and support guidance; do not treat a successful update check as proof that this CVE is resolved. [2] [3] [4]
The deadline and the compromise check are separate jobs
The September 21 dates belong to CISA’s federal remediation framework. BOD 26-04 applies to covered Federal Civilian Executive Branch systems and uses exposure, exploitation, automation and technical impact to prioritize action. It is not a universal legal deadline for every private Linux user. [5]
Operators should also notice the forensic-triage flag. CISA’s implementation guidance calls for collecting relevant evidence before remediation when possible, then checking for unauthorized access, persistence or other signs of compromise. Patching closes a vulnerability; it does not establish whether someone used it earlier. Coordinate evidence collection and updates with the incident-response team instead of wiping a suspicious host first. [6]
Earlier coverage of Linux container escape CVE-2026-53362 concerns a different flaw and patch. For this alert, track the three identifiers individually, verify the supported fix for each affected kernel branch, and keep the compromise review separate from the patch-completion checkbox.
References
- CISA. Known Exploited Vulnerabilities Catalog, three Linux kernel entries added September 18, 2026. Accessed September 20, 2026. Official catalog data.
- Canonical. CVE-2025-39682: description and Ubuntu package status. Updated September 17; accessed September 20, 2026. Ubuntu advisory.
- Canonical. CVE-2025-39964: description and Ubuntu package status. Updated September 10; accessed September 20, 2026. Ubuntu advisory.
- Canonical. CVE-2026-53266: description and Ubuntu package status. Updated September 18; accessed September 20, 2026. Ubuntu advisory.
- CISA. BOD 26-04: Prioritizing Security Updates Based on Risk. June 10, 2026. Directive and scope.
- CISA. BOD 26-04 implementation guidance, forensic triage requirements. Accessed September 20, 2026. Evidence collection and triage.
