Reported by 25 outlets

Timeline

1. original reporting

   CISA alerts of active exploitation of three Linux kernel flaws https:// bleepingcomputer.com/news/security/ cisa-alerts-of-active-exploitati

   www.bleepingcomputer.com · 22d ago · September 21st, 2026

   CISA alerts of active exploitation of three Linux kernel flaws https:// bleepingcomputer.com/news/security/ cisa-alerts-of-active-exploitati

   via X https://www.bleepingcomputer.com/news/security/cisa-alerts-of-active-exploitation-of-three-linux-kernel-flaws/

2. update from nvd.nist.gov

   NVD: CVE-2025-39682 (tls: fix handling of zero-length records on the rx_list)

   nvd.nist.gov · 403d ago · September 5th, 2025

   The kernel.org CNA record for the kTLS receive-path flaw was published September 5, 2025, almost a year before the KEV listing. It fixes the affected range as kernels 6.0 onward (introduced by commit 84c61fe1) and lists the stable fix releases 6.1.149, 6.6.103, 6.12.44, 6.16.4, and 6.17. The kernel.org CVSS v3.1 score is 9.8.

3. update from nvd.nist.gov

   NVD: CVE-2025-39964 (crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg)

   nvd.nist.gov · 365d ago · October 13th, 2025

   The kernel.org CNA record for the AF_ALG race condition was published October 13, 2025, eleven months before CISA flagged active exploitation. The fix adds a ctx->write exclusive-ownership field so a second concurrent writer receives -EBUSY, and the record traces the vulnerable code back to commit 8ff590903d5f, which shipped with Linux 2.6.38 in 2011.

4. update from nvd.nist.gov

   NVD: CVE-2026-53266 (netfilter: bridge: make ebt_snat ARP rewrite writable)

   nvd.nist.gov · 110d ago · June 25th, 2026

   The kernel.org CNA record for the ebtables SNAT out-of-bounds write was published June 25, 2026, roughly three months before the KEV listing. The flaw lets the ARP sender-hardware-address rewrite write through skb_store_bits() into a nonlinear fragment backed by a splice-imported file page without the range first being made writable. It was introduced in 5.10 by commit 63137bc5882a and fixed across 5.10.259 through 7.1, scored CVSS v3.1 8.8 by kernel.org.

5. update from github.com

   Add kernelCTF CVE-2025-39964_lts_cos_mitigation

   github.com · 63d ago · August 11th, 2026

   Google's security-research repository published a working privilege escalation exploit for CVE-2025-39964 on August 11, 2026, five weeks before the KEV listing. The submission (kernelCTF exp413 and exp415) targets the lts-6.12.44, mitigation-v4-6.6, and COS environments with a stated 99 percent success rate, and its metadata lists CONFIG_CRYPTO_USER_API as the only kernel requirement. Because AF_ALG is reachable from inside a container, the same chain serves as a Docker escape to the host kernel.

6. update from secdb.nttzen.cloud

   🚨 [CISA-2026:0918] CISA Adds 2 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:

   secdb.nttzen.cloud · 25d ago · September 18th, 2026

   🚨 [CISA-2026:0918] CISA Adds 2 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:

   via Mastodon https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0918

7. update from www.all-about-security.de

   Linux Kernel Security Flaws: CISA Warns of Active Exploitation Evidence indicates the vulnerabilities are already being exploited.

   www.all-about-security.de · 24d ago · September 19th, 2026

   Linux Kernel Security Flaws: CISA Warns of Active Exploitation Evidence indicates the vulnerabilities are already being exploited. via Mastodon https://www.all-about-security.de/linux-kernel-sicherheitsluecken-cisa-warnt-vor-aktiver-ausnutzung/

8. update from thehackernews.com

   🤖 CISA added 3 Linux kernel flaws to KEV over in-the-wild exploitation: CVE-2025-39682 (CVSS 9.8, TLS receive path, memory disclosure/DoS),

   thehackernews.com · 24d ago · September 19th, 2026

   🤖 CISA added 3 Linux kernel flaws to KEV over in-the-wild exploitation: CVE-2025-39682 (CVSS 9.8, TLS receive path, memory disclosure/DoS),

   via Mastodon https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html

9. update from osintsights.com

   CISA Flags Linux Kernel Flaws Exploited in Wild Linux kernel flaws are being actively exploited in the wild, prompting CISA to add three vul

   osintsights.com · 24d ago · September 19th, 2026

   CISA Flags Linux Kernel Flaws Exploited in Wild Linux kernel flaws are being actively exploited in the wild, prompting CISA to add three vul

   via Mastodon https://osintsights.com/cisa-flags-linux-kernel-flaws-exploited-in-wild?utm_source=mastodon&utm_medium=social

10. update from theperimetersite.com

    Three is the number here; that's how many days CISA gave US federal agencies to patch three Linux kernel vulnerabilities before the Monday,

    theperimetersite.com · 24d ago · September 19th, 2026

    Three is the number here; that's how many days CISA gave US federal agencies to patch three Linux kernel vulnerabilities before the Monday,

    via Mastodon https://theperimetersite.com/report/279

11. mentioned by thehackernews.com

    🤖 CISA adds 3 Linux kernel flaws to KEV over active exploitation: CVE-2025-39682 (CVSS 9.8, TLS receive-path memory disclosure/DoS), CVE-202

    thehackernews.com · 24d ago · September 19th, 2026

12. update from www.yazoul.net

    🔵 THREAT INTELLIGENCE CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild Vulnerability | CRITICAL CVEs: CVE-2025-39682 The

    www.yazoul.net · 24d ago · September 19th, 2026

    🔵 THREAT INTELLIGENCE CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild Vulnerability | CRITICAL CVEs: CVE-2025-39682 The

    via Mastodon https://www.yazoul.net/news/article/cisa-flags-three-linux-kernel-vulnerabilities-exploited-in-the-wild

13. mentioned by beyondmachines.net

    CISA Warns of Active Exploitation of Three Linux Kernel Vulnerabilities CISA added three Linux kernel vulnerabilities (CVE-2025-39682, CVE-2

    beyondmachines.net · 23d ago · September 20th, 2026

14. mentioned by cyber.netsecops.io

    📰 CISA: Three Linux Kernel Flaws Actively Exploited in the Wild CISA adds 3 actively exploited Linux kernel vulnerabilities to its KEV catal

    cyber.netsecops.io · 23d ago · September 20th, 2026

15. mentioned by threat-intelligence.redeyesecurity.com

    CISA added three Linux kernel flaws to the KEV catalog. Federal agencies get two days to patch. KEV means confirmed exploitation, not theory

    threat-intelligence.redeyesecurity.com · 23d ago · September 20th, 2026

16. update from securebulletin.com

    CISA Orders Forensic Checks as Three Linux Kernel Flaws Face Active Exploitation # CyberSecurity https:// securebulletin.com/cisa-orders -fo

    securebulletin.com · 23d ago · September 20th, 2026

    CISA Orders Forensic Checks as Three Linux Kernel Flaws Face Active Exploitation # CyberSecurity https:// securebulletin.com/cisa-orders -fo

    via Mastodon https://securebulletin.com/cisa-orders-forensic-checks-as-three-linux-kernel-flaws-face-active-exploitation/

17. mentioned by www.heise.de

    CISA warns 3 CVEs are under active exploitation in the wild: - CVE-2025-39964 Linux Kernel Race Condition Vulnerability - CVE-2026-53266 Lin

    www.heise.de · 22d ago · September 21st, 2026

18. update from securityweek.com

    Organizations Warned of 3 Exploited Linux Kernel Vulnerabilities

    securityweek.com · 22d ago · September 21st, 2026

    Tracked as CVE-2025-39682 (CVSS score of 9.8), the first of the bugs is a critical-severity issue impacting the kernel’s handling of zero-length records on the rx_list in the TLS receive path. This is a corner case where the recvmsg() logic – each recvmsg() call processes either DATA or non-DATA records – breaks out of the processing loop when an initial zero-length record is pulled from rx_list. When zero-copy decryption occurs, the kernel decrypts ciphertext into a user-space buffer. Because zero-copy is permitted only with DATA records, the vulnerable function assumes that no type change can occur after the zero-copy, but the logic can be broken using a zero-length record originating from rx_list. A local attacker could exploit this improper check for unusual or exceptional conditions to cause a denial-of-service (DoS) condition or trigger memory disclosure. The second vulnerability, CVE-2025-39964 (CVSS score of 7.8), is described as a race condition: issuing two writes to the same AF_ALG socket leads to data being interleaved in an unpredictable fashion. An attacker could trigger the security defect to create inconsistencies in the socket’s internal state, leading to system crashes or corrupted cryptographic operation results, which c

19. mentioned by cybersecurefox.com

    CISA adds three Linux kernel vulnerabilities to KEV catalog (kTLS, ebtables, AF_ALG) 🔗 https:// cybersecurefox.com/en/cisa-thr ee-linux-kern

    cybersecurefox.com · 22d ago · September 21st, 2026

20. update from radar.offseq.com

    Linux kernel: 3 CRITICAL vulns (now in CISA KEV) allow local DoS, memory leaks, or unauthorized memory writes. All orgs should patch ASAP. N

    radar.offseq.com · 22d ago · September 21st, 2026

    Linux kernel: 3 CRITICAL vulns (now in CISA KEV) allow local DoS, memory leaks, or unauthorized memory writes. All orgs should patch ASAP. N

    via Mastodon https://radar.offseq.com/threat/organizations-warned-of-3-exploited-linux-kernel-vulnerabilities-1c077e64a021762d

21. update from insomnisec.com

    CISA Adds Three Linux Kernel Vulnerabilities to the KEV Catalog: What You Need to Know On September 18, 2026, the Cybersecurity and Infrastr

    insomnisec.com · 22d ago · September 21st, 2026

    CISA Adds Three Linux Kernel Vulnerabilities to the KEV Catalog: What You Need to Know On September 18, 2026, the Cybersecurity and Infrastr

    via Mastodon https://insomnisec.com/posts/2026-09-21-cisa-kev-linux-kernel-trio_insomnisec_v2/

22. update from bleepingcomputer.com

    CISA alerts of active exploitation of three Linux kernel flaws

    bleepingcomputer.com · 22d ago · September 21st, 2026

    Cybersecurity and Infrastructure Security Agency (CISA) is warning that hackers are exploiting three Linux kernel vulnerabilities, one of them rated critical. The three security issues were added separately last week and have severity ratings ranging from medium to critical. CISA marked all three flaws with the highest priority for federal agencies, ordering them to apply available security updates and mitigations by the end of today. CVE-2025-39682: a Linux kernel TLS receive-path logic flaw that mishandles zero-length records queued for later processing, potentially allowing different TLS record types to be processed together when kTLS is in use. CISA says [ 1 , 2 ] the vulnerabilities have been exploited in attacks but has not revealed any details about the incidents or the nature of the threat actors. Offensive security company STAR Labs found CVE-2025-39964, saying that its researchers found the issue with no help fro

23. mentioned by www.bleepingcomputer.com

    🤖 CISA adds 3 Linux kernel flaws to its KEV, warns of active exploitation. Critical CVE-2025-39964 (14-yo): AF_ALG crypto socket race → LPE

    www.bleepingcomputer.com · 22d ago · September 21st, 2026

24. mentioned by www.bleepingcomputer.com

    "CISA alerts of active exploitation of three Linux kernel flaws" "[...] Cybersecurity and Infrastructure Security Agency (CISA) is warning t

    www.bleepingcomputer.com · 22d ago · September 21st, 2026

25. mentioned by www.bleepingcomputer.com

    🤖 CISA warns of active exploitation of 3 Linux kernel flaws (1 critical), added to its KEV catalog: • CVE-2025-39682 – kTLS receive-path fla

    www.bleepingcomputer.com · 22d ago · September 22nd, 2026

26. mentioned by www.clubic.com

    CISA confirms active exploitation of 15-year-old Linux flaw CVE-2025-39964, CVE-2026-53266, CVE-2025-39682

    www.clubic.com · 21d ago · September 22nd, 2026

27. mentioned by www.cisa.gov

    :linux: CISA flags three Linux Kernel Vulnerabilities Exploited in the Wild. The U.S. Cybersecurity and Infrastructure Security Agency [CISA

    www.cisa.gov · 21d ago · September 22nd, 2026

28. update from blog.qualys.com

    CISA BOD 26-04 Timelines for Three Linux Kernel CVEs

    blog.qualys.com · 20d ago · September 23rd, 2026

    Under CISA BOD 26-04, a 3-day window applies to CVE-2025-39682 across all assets, and for the other two, the deadline is 3 days for publicly exposed assets and 14 days for internal assets. With the September 21 deadline now passed, affected systems should be patched immediately. Qualys TruRisk Eliminate identifies affected assets with vulnerability context and provides High-Reliability Patches to support remediation and verification. The Three Linux Kernel CVEs in KEV Red Hat has updated its advisories for all three to acknowledge active exploitation and reports that public exploits are known. Observed exposure across organizations shows these vulnerabilities can affect a substantial number of systems, including internet-facing assets, making timely remediation essential.

29. mentioned by starlabs.sg

    (starlabs.sg) Analysis of CVE-2025-39964: A Race Condition in AF_ALG Leading to Linux Kernel Local Privilege Escalation In brief - This arti

    starlabs.sg · 19d ago · September 24th, 2026

30. update from cyberpress.org

    14-Year-Old Linux Kernel Vulnerability Lets Attackers Gain Root and Escape Containers

    cyberpress.org · 18d ago · September 25th, 2026

    A 14-year-old Linux kernel flaw in the AF_ALG cryptographic socket interface can allow unprivileged local users to gain root privileges and escape Docker containers. Security researcher Muhammad Alifa Ramdhan discovered the issue in 2025 while auditing Linux kernel attack surfaces for Google’s kernelCTF program. 14-Year-Old Linux Kernel Vulnerability The research, completed with assistance from STAR Labs colleague Bing-Jhong Billy Jheng, produced a working local privilege-escalation exploit and earned a $113,337 kernelCTF reward. AF_ALG data flow (Source: idnsec) It enables applications to request cryptographic operations through sockets, making it accessible to ordinary users without elevated privileges. An application can create an AF_ALG socket, bind it to a cryptographic algorithm such as AES-CBC , and submit input through sendmsg() for later encryption or decryption. The kernel stores submitted bytes in scatter-gather lists, which track memory pages and their offsets. Normally, when a partial pag

31. mentioned by gbhackers.com

    14-Year-Old Linux Kernel Vulnerability Enables Root Access and Docker Escape

    gbhackers.com · 18d ago · September 25th, 2026