CISA ADDS TWO ACTIVELY EXPLOITED LINUX KERNEL VULNERABILITIES TO KEV CATALOG: RACE CONDITION AND OUT-OF-BOUNDS WRITE NOW REQUIRE PRIORITY REMEDIATION

THREAT SUMMARY

Category: Actively Exploited Vulnerabilities / Linux Kernel / Local Privilege and Memory-Safety Risk
Affected Product(s): Linux Kernel
CVE(s): CVE-2025-39964, CVE-2026-53266
Primary Risks: Race condition, inconsistent kernel socket state, out-of-bounds write, memory corruption, denial of service, potential privilege escalation, and follow-on compromise depending on system configuration and exploitation path
Threat Status: Active exploitation confirmed by CISA
Affected Environment(s): Linux servers, workstations, appliances, virtualized systems, container hosts, network infrastructure, and other products incorporating affected Linux kernel versions or components
Attack Vector(s): Local access to vulnerable kernel interfaces, concurrent operations against AF_ALG sockets, and abuse of affected ebtables bridge SNAT handling involving ARP sender hardware address rewriting
CISA Action: Two Linux Kernel vulnerabilities added to the Known Exploited Vulnerabilities Catalog on September 18, 2026
Required Response: Federal Civilian Executive Branch agencies must follow applicable BOD 26-04 vulnerability-management requirements. CISA encourages all organizations to prioritize remediation of KEV vulnerabilities.

---

CISA has added two Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities Catalog after determining that both are being exploited in real-world attacks. The September 18 additions are CVE-2025-39964, a race condition affecting Linux kernel cryptographic socket handling, and CVE-2026-53266, an out-of-bounds write vulnerability affecting Linux bridge netfilter and ebtables SNAT processing.

The additions are significant because Linux kernels sit underneath an enormous range of enterprise systems, servers, cloud workloads, network appliances, development environments, virtualization platforms, and embedded products. A kernel-level vulnerability can create consequences far beyond an individual application because successful exploitation can interfere directly with operating-system memory, networking, permissions, and process isolation.

CISA’s decision to add both vulnerabilities to KEV confirms that exploitation has moved beyond laboratory research or theoretical risk. Both vulnerabilities must now be evaluated as active threats.

---

Vulnerability Details

CVE-2025-39964 — Linux Kernel AF_ALG Race Condition Vulnerability

CISA identified CVE-2025-39964 as an actively exploited race condition vulnerability in the Linux kernel.

The flaw affects the kernel’s AF_ALG cryptographic socket interface, specifically the handling of concurrent writes through af_alg_sendmsg.

The underlying problem occurs when two writes are issued to the same AF_ALG socket at the same time.

Linux kernel maintainers determined that concurrent writes could cause data to become unpredictably interleaved and create inconsistencies inside the socket’s internal state. The upstream fix introduced exclusive ownership during writing so that multiple operations cannot manipulate the affected socket simultaneously.

Race conditions occur when multiple operations access or modify shared data in an unsafe sequence and system behavior depends on timing.

At the kernel level, that can become particularly dangerous because the affected operations occur inside privileged operating-system code.

The CVE record assigns a CVSS 3.1 score of 7.8, with a local attack vector, low attack complexity, low privileges required, and no user interaction.

That scoring indicates exploitation generally requires some level of local access rather than unauthenticated exploitation directly across the internet.

Local does not mean low risk.

An attacker who has already obtained limited access to a Linux system could potentially use a kernel vulnerability as part of a privilege-escalation chain, escape from restricted execution contexts, interfere with system stability, or deepen an existing compromise.

CISA lists the vulnerability under CWE-362, the weakness category associated with concurrent execution using shared resources with improper synchronization.

The vulnerability affects multiple historical Linux kernel branches, and fixes have been backported across stable releases. Organizations should rely on their Linux distribution or appliance vendor’s security guidance rather than assuming a particular upstream version number applies uniformly across every deployment.

---

CVE-2026-53266 — Linux Kernel Out-of-Bounds Write Vulnerability

CVE-2026-53266 is an actively exploited out-of-bounds write vulnerability affecting the Linux kernel’s netfilter bridge ebtables SNAT functionality.

The issue exists in the handling of ARP sender hardware address rewriting.

The vulnerable code path can write data into a nonlinear socket-buffer fragment backed by a splice-imported file page without first ensuring the affected memory range is safely writable.

That creates a memory-corruption condition.

An out-of-bounds write occurs when software writes data beyond the memory area legitimately allocated or expected for an operation.

Inside a kernel, that class of vulnerability can be especially serious because corrupted memory may belong to privileged structures, shared pages, networking buffers, or other critical operating-system components.

The vulnerability affects the ebtables SNAT target when ARP sender hardware addresses are rewritten on bridge traffic.

Red Hat describes the flaw as capable of causing memory corruption, denial of service, or potential local privilege escalation under affected configurations. Exploitation requires specific bridge netfilter rules and local access conditions, reducing universal exposure but not eliminating the risk to systems where that configuration exists.

CISA associates CVE-2026-53266 with CWE-787, Out-of-Bounds Write.

The kernel fix changes the affected path so that the ARP sender hardware address range is made writable before the kernel performs the modification.

Systems using Linux bridge networking, ebtables, virtual networking, container networking, specialized appliances, or other environments relying on bridge-based traffic manipulation deserve particular attention.

This vulnerability should not be treated as affecting every Linux installation in exactly the same way.

Exposure depends on the kernel build, vendor package, and whether the affected bridge netfilter functionality is present and configured.

CISA added CVE-2026-53266 to KEV on September 18 based on evidence of active exploitation.

---

Operational Impact

The two vulnerabilities affect different Linux kernel subsystems, but both share one important characteristic: exploitation occurs below the application layer.

• CVE-2025-39964 affects the AF_ALG cryptographic socket interface and creates unsafe concurrent kernel operations.
• CVE-2026-53266 affects bridge netfilter and ebtables SNAT memory handling.
• Both vulnerabilities are associated with confirmed active exploitation.
• Both can affect operating-system integrity rather than a single application.
• CVE-2025-39964 may be useful after an attacker already obtains local access and seeks deeper system control.
• CVE-2026-53266 creates a memory-corruption primitive in specific bridge networking configurations.
• Systems running Linux as a virtualization host or container host may carry broader operational consequences if the underlying kernel is compromised.
• Network appliances and security products that incorporate Linux may also inherit vulnerable kernel components depending on vendor implementation.
• Cloud and infrastructure environments should not assume that an application-level patch inventory will detect these exposures because the vulnerable component resides in the operating system itself.

The presence of Linux kernel flaws in KEV also complicates remediation because organizations may not always directly manage the affected kernel.

Some systems receive kernels through commercial Linux distributions.

Others are embedded inside firewalls, appliances, storage platforms, telecommunications products, or managed infrastructure.

That means defenders must identify both conventional Linux hosts and products built on Linux.

---

Federal Response

BOD 26-04 establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies and uses KEV status as a primary signal for accelerated remediation.

That guidance matters because patching answers only one question:

Is the vulnerability still exploitable?

It does not answer the second:

Was the system already compromised before remediation?

Systems exposed during an active exploitation period may require examination for suspicious processes, kernel activity, privilege changes, persistence mechanisms, account manipulation, unexpected network behavior, altered files, or other indicators of compromise.

---

KEV

CISA adds vulnerabilities to the Known Exploited Vulnerabilities Catalog when they meet defined requirements that include:

• A valid CVE identifier.
• Reliable evidence of exploitation.
• Availability of actionable mitigation or remediation guidance.

KEV status distinguishes vulnerabilities that attackers are actually using from the much larger population of disclosed vulnerabilities that may never see meaningful exploitation.

Both September 18 entries meet that threshold.

CISA lists ransomware usage for both vulnerabilities as unknown, meaning the agency has not publicly established whether either flaw is currently being used in ransomware campaigns.

Unknown ransomware association should not be interpreted as absence of malicious exploitation.

KEV inclusion already establishes that exploitation has occurred.

The more important operational question is whether affected Linux kernels exist in the organization and whether the systems were exposed to conditions that make exploitation possible.

---

Defensive Guidance

Organizations operating Linux infrastructure should immediately determine whether affected kernels or vendor packages are deployed.

Priority actions should include:

• Inventory Linux servers, workstations, hypervisors, container hosts, network appliances, embedded devices, and security platforms.
• Identify vendor products that incorporate Linux kernels even when Linux is not visible to ordinary administrators.
• Check distribution and appliance vendor advisories for fixes addressing CVE-2025-39964 and CVE-2026-53266.
• Apply supported kernel security updates as soon as operationally possible.
• Reboot systems where required to ensure the updated kernel is actually running.
• Do not assume installation of a kernel package means remediation is complete until the system has booted into the patched kernel.
• Review systems using AF_ALG cryptographic sockets for exposure to CVE-2025-39964.
• Identify systems using Linux bridge networking, ebtables, or bridge SNAT rules involving ARP rewriting for exposure to CVE-2026-53266.
• Review privileged local account activity and unexpected escalation events.
• Investigate suspicious crashes, kernel errors, memory faults, or unexplained service instability.
• Examine authentication logs, process creation, account changes, sudo activity, container events, and security telemetry for evidence of post-exploitation behavior.
• Review virtualization and container hosts carefully because kernel compromise can affect multiple workloads running on the same host.
• Conduct forensic triage on systems that CISA guidance identifies as requiring assessment under BOD 26-04.
• Preserve logs and forensic evidence before rebuilding systems where compromise is suspected.
• Confirm patched kernel versions through runtime verification rather than package-management records alone.

For CVE-2026-53266 specifically, environments using bridge netfilter should review whether ebtables SNAT rules perform ARP sender hardware address rewriting.

Where immediate patching cannot be completed, administrators should use only vendor-supported mitigations for the affected configuration.

---

30-Day Outlook

The immediate threat surrounding these vulnerabilities is likely to remain elevated because public KEV inclusion changes attacker and defender behavior at the same time.

Organizations should expect:

• Expanded scanning and exploitation attempts against systems known to contain vulnerable Linux kernels.
• Increased interest in developing reliable exploitation chains for local privilege escalation.
• Greater targeting of Linux infrastructure already compromised through stolen credentials, exposed services, web applications, or other initial-access mechanisms.
• Attempts to combine application vulnerabilities with Linux kernel vulnerabilities to move from limited access to stronger privileges.
• Increased scrutiny of container and virtualization hosts where kernel-level access could have broader impact.
• More vendor advisories identifying affected downstream products that embed vulnerable kernel versions.
• Additional detection logic aimed at identifying exploitation artifacts or suspicious post-exploitation behavior.
• Greater attention to bridge networking and ebtables configurations associated with CVE-2026-53266.
• Continued emphasis on forensic review for systems patched only after the active exploitation period began.

These vulnerabilities are particularly relevant to attack chains.

Neither flaw needs to serve as the initial point of entry to become dangerous.

An attacker may first compromise a vulnerable web service, steal credentials, exploit a remote application, or obtain access through another method.

A kernel vulnerability can then become the mechanism used to elevate privileges or gain broader system control.

That makes KEV status especially important even for vulnerabilities classified with local attack vectors.

---

TRJ Verdict

The September 18 KEV update is small in number but significant in depth.

Only two vulnerabilities were added, yet both affect the Linux kernel itself.

CVE-2025-39964 introduces a race condition in the AF_ALG cryptographic socket subsystem that can destabilize internal kernel state through unsafe concurrent writes.

CVE-2026-53266 creates an out-of-bounds write condition in bridge netfilter handling that can result in memory corruption and potential privilege escalation under affected configurations.

The central issue is not simply severity scoring.

It is confirmed exploitation.

Both vulnerabilities have already crossed the threshold from disclosed weakness to operational threat.

CISA’s decision to place both vulnerabilities in the KEV Catalog reinforces the need to move affected systems out of routine maintenance queues and into priority remediation.

Organizations should identify vulnerable Linux kernels immediately, apply supported updates, verify the patched kernel is actually running, and conduct compromise assessment where active exploitation may have preceded remediation.

For Linux infrastructure, patching the kernel is only half the job.

The other half is determining whether an attacker reached it first.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---