Three Linux kernel vulnerabilities exploited, CISA warns

Three Linux kernel vulnerabilities are now flagged as being used by real attackers. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-39682, CVE-2026-53266 and CVE-2025-39964 to its Known Exploited Vulnerabilities (KEV) catalog on Friday, citing evidence of active exploitation. The KEV catalog is a public list of security bugs that CISA has seen used in real attacks, and a listing there is widely treated by IT teams as a signal to patch without waiting for the next maintenance window. Each of the three carries a CVSS score, the standard one to ten measure of how serious a security bug is: 9.8 for CVE-2025-39682, 8.8 for CVE-2026-53266 and 7.8 for CVE-2025-39964. All three affect the Linux kernel, the core part of the operating system that manages memory, hardware and running programs underneath most web servers, containers and cloud instances.

The first of the three, CVE-2025-39682, is described as an improper check for unusual or exceptional conditions in the TLS receive path. TLS, or Transport Layer Security, is the encryption that protects the connection between a browser and a website. According to the advisory, the weakness could allow a local authenticated user, meaning someone who already holds an account on the machine, to trigger memory disclosure or a denial of service. Memory disclosure means data held in the computer's memory could be exposed to someone who should not see it, while a denial of service means the system is crashed or made unusable for legitimate work.

CVE-2026-53266 is an out-of-bounds write, a bug in which a program stores data outside the memory area reserved for it, and it sits in the ebtables Source Network Address Translation (SNAT) Address Resolution Protocol (ARP) rewrite path. ebtables is a Linux component that filters network traffic between virtual machines and containers. The flaw could allow a local attacker to trigger unintended system behaviour, a denial of service, or local privilege escalation, which means climbing from ordinary access to the higher rights of an administrator.

CVE-2025-39964 is a race condition that permits concurrent writes to the same AF_ALG socket. A race condition is a bug that appears when two parts of a program use the same resource at the same moment and interfere with each other. AF_ALG is the Linux interface that programs use to reach the kernel's cryptographic functions. Here a local attacker could crash the system or corrupt the results of cryptographic operations, producing a denial of service or data integrity issues, where integrity means the data can no longer be trusted to be correct.

The source report states plainly that there are currently no details on how the three vulnerabilities are being exploited in the wild, and no information on whether they are being weaponised as part of a single attack chain. That uncertainty is worth naming rather than papering over: the CISA listing confirms that exploitation has happened, but the material available does not explain the mechanics behind it.

Red Hat, one of the largest commercial Linux vendors, has updated its advisories for all three flaws as of September 19, 2026 at 2 a.m. UTC to acknowledge active exploitation. In its advisory wording, Red Hat says: "This CVE is high risk and there are known public exploits leveraging this vulnerability," and adds: "Address this vulnerability with high priority." Red Hat's packages sit behind a large share of the servers and container images that run websites and business applications, so its assessment carries weight beyond its own customer base.

Under Binding Operational Directive (BOD) 26-04, titled Prioritizing Security Updates Based on Risk, federal civilian executive branch agencies in the United States are recommended to apply the necessary fixes by September 21, 2026. The directive is an instruction from CISA to government departments. It does not bind private companies, but many corporate IT teams use deadlines of this kind as a benchmark for their own patching calendars.

Two characteristics run through all three bugs. They are local, so an attacker generally needs an existing foothold on the machine, such as a stolen account or a vulnerable web application, before the flaw can be turned into any real progress. That makes them useful as a second step in an intrusion rather than as a way in. And they affect Linux, which underpins web hosting: a single physical server often runs many websites belonging to many different customers, so a bug that lets an ordinary user gain more rights or crash the machine is a concern not only for the server operator but for every site hosted on it.

The KEV listings also arrive alongside separate research. A security researcher named Asim Manizada disclosed four local privilege escalation flaws affecting the Linux kernel, each given a nickname: CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject) and CVE-2026-74469 (DiagSpill). These come from a different source than the CISA listing and should not be confused with the three exploited flaws above.

For readers who run a website, the practical question is who is responsible for the kernel in the first place. On managed or shared hosting the operating system is the provider's to maintain, and the useful action is to confirm that updates have been applied rather than to try to patch a server you do not control. On a server you administer yourself, the fix arrives through your Linux distribution's normal security updates, and the priority Red Hat has attached to these three flaws is a clear reason not to postpone them. Readers who would rather hand the server layer to someone else can look at managed WordPress hosting such as AEU Hosting, one of AEU Group's services, where the platform is maintained by the provider and the site owner looks after the website itself.