CISA adds three Linux kernel flaws to its exploited catalog, all of them in the network plumbing
On September 18, 2026, CISA added three Linux kernel vulnerabilities to the KEV catalog: a race in AF_ALG, an out-of-bounds write in ebtables SNAT, and mishandled zero-length TLS records. Patch before September 21 and confirm your distribution has backported all three commits.
September 18, 2026. CISA adds three Linux kernel vulnerabilities to its KEV catalog — the list of flaws exploited in the wild — in a single day. October 13, 2025. The first, CVE-2025-39964, was published to the NVD. September 21, 2026. The deadline imposed on US federal agencies to remediate. Why it matters: all three bugs live in the kernel’s network and crypto plumbing — netfilter, kernel TLS, crypto sockets — not in exotic drivers, which means they affect nearly every Linux server, not a hardware niche.
Three old bugs, one day
The signal is not in the severity of any single flaw but in their co-occurrence. CVE-2025-39964 dates from October 2025, CVE-2025-39682 from September 2025, and CVE-2026-53266 from June 2026. Their simultaneous entry into the KEV on September 18, 2026 means one thing: CISA now has evidence that these bugs — fixed upstream months ago — are being actively exploited by attackers today.
This is the classic patch-lag scenario. The fixing commits have existed in the kernel’s stable branches for a long time — some for over a year — but servers still run kernels or distributions that never backported them. The KEV listing is how CISA turns that lag into a deadline.
ebtables SNAT: writing out of bounds into a file page
The most serious of the three is CVE-2026-53266, rated CVSS 8.8 with a scope change (S:C). It targets the SNAT target of ebtables, the Ethernet-bridge firewall in the netfilter subsystem. In practice, SNAT rewrites the sender hardware address of an ARP packet so it matches the bridge’s. The fix’s own title is telling: “netfilter: bridge: make ebt_snat ARP rewrite writable” — make that rewrite writable.
The flaw is that this ARP rewrite could write directly into a non-linear fragment of the socket buffer when it was backed by a splice-imported file page. In other words, a MAC address rewrite could corrupt memory beyond its intended region — an out-of-bounds write in the same family as historically exploited netfilter bugs such as CVE-2023-32233 and CVE-2022-25636. The AV:L (local) vector hides a crucial point: with a scope change, compromise from within a container or namespace can spill over to the host.
AF_ALG: two concurrent writes on a crypto socket
CVE-2025-39964 (CVSS 7.8) hits AF_ALG, the socket interface through which user space offloads crypto operations to the kernel. The bug is a race condition: two writes (sendmsg) issued simultaneously on the same AF_ALG socket interleaved data unpredictably and created inconsistencies in the socket’s internal state.
The fix — “crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg” — introduces a ctx->write field that enforces exclusive write ownership. It is a textbook TOCTOU applied to a data path: the API documentation never forbade concurrent writes, but the implementation was not ready to handle them. The consumers of AF_ALG are less visible than OpenSSL, but they exist — some TLS stacks and hardware-crypto libraries still offload primitives to the kernel through this socket.
Kernel TLS: the zero-length record that breaks zero-copy
CVE-2025-39682 carries the highest score of the three — CVSS 9.8, critical, network. It concerns the kernel’s TLS receive path (net/tls), used by kTLS to offload TCP encryption into the kernel. The defect is a zero-length TLS record placed on the rx_list: such a record bypassed the intended record-type handling in recvmsg(), which could cause subsequent TLS records to be processed under incorrect zero-copy and queuing assumptions.
The fix — “tls: fix handling of zero-length records on the rx_list” — restores the rule that each recvmsg() call processes either contiguous DATA records or one non-DATA record. The concrete risk targets deployments that enable kTLS for TLS termination — for example service meshes offloading encryption onto sendfile workloads. A wrong zero-copy assumption at that point can translate into data leakage or corruption, hence the critical score.
BOD 26-04: a deadline, not a suggestion
The simultaneous KEV listing carries a precise procedural consequence. Under directive BOD 26-04 (Prioritizing Security Updates Based on Risk), US federal agencies must remediate all three flaws before September 21, 2026 — just three days after listing. That compressed window contrasts with the usual timelines and reflects CISA’s conviction that exploitation is already underway.
The lesson for a team that is not a federal agency is the same, minus the legal obligation. These flaws do not demand a brand-new 7.x kernel: they demand that the distribution has backported three specific commits into its stable branch. Verification is not done on the version number alone but on the actual presence of the fixes:
# Running kernel and its provenance
uname -a
# The three commits are backported in the stable branches; check the
# distribution changelog rather than the version number alone.
# Debian / Ubuntu:
zcat "/usr/share/doc/linux-image-$(uname -r)/changelog.gz" 2>/dev/null | grep -iE 'af_alg|ebt_snat|zero-length record|CVE-2025-39964|CVE-2026-53266|CVE-2025-39682' | head
# RHEL / Fedora:
rpm -q --changelog kernel 2>/dev/null | grep -iE 'af_alg|ebt_snat|zero-length record|CVE-2025-39964|CVE-2026-53266|CVE-2025-39682' | headIf the command returns none of the three identifiers, the fix is not applied, whatever the displayed version.
This trio belongs to a recent run of bugs in the kernel’s networking subsystem that we have been following closely — from the IPv6 fragmentation container escape (CVE-2026-53362) to the BPF verifier hardening in Linux 7.3. The through-line is clear: the kernel’s network plumbing has become a prime hunting ground because it is ubiquitous, old, and runs with high privilege — the three properties an attacker looks for first.
Verdict
The three KEV entries of September 18 tell a single story: these are not fresh zero-days but old, undeployed fixes now being exploited. If you run exposed Linux servers, treat September 21 as your own deadline and confirm the three commits actually appear in your distribution’s changelog — not just the kernel number. If you run multi-tenant containers, prioritise CVE-2026-53266: its scope change makes it the most likely container-escape candidate. If you enable kTLS, audit your sendfile terminations and apply CVE-2025-39682 first, since its 9.8 score reflects remote, unauthenticated impact.