Security teams have been given an unusually short runway to address three Linux kernel vulnerabilities now confirmed to be under active exploitation. The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2025-39682, CVE-2026-53266 and CVE-2025-39964 to its Known Exploited Vulnerabilities catalog on September 18, setting a September 21 remediation deadline for covered federal civilian agencies.

The directive goes beyond installing updates. CISA marked all three entries for forensic triage, meaning organizations must also look for signs that vulnerable systems were reached before they were patched. Although the agency has not disclosed the attackers, victims or observed techniques, KEV inclusion establishes that exploitation has occurred in real-world attacks.

Critical flaw reaches the kernel TLS receive path

The most severe issue is CVE-2025-39682, rated 9.8 on the CVSS scale. It concerns an improper condition check in the receive path for kernel TLS, or kTLS. A zero-length record retrieved from a queue can bypass the expected record-type handling, allowing later TLS records to be processed with unsafe assumptions about zero-copy operations and queuing.

Systems are relevant when kTLS is enabled and connected to TCP sockets. According to the source report, Red Hat considers the affected path remotely triggerable in that configuration, putting exposed services that use the feature at the front of the patching queue. Administrators should rely on fixed packages from their Linux distributor rather than trying to determine safety from a generic upstream version alone.

Netfilter and cryptographic interfaces add local risk

CVE-2026-53266 is an out-of-bounds write in the netfilter bridge ebtables SNAT target and carries a CVSS score of 8.8. When an optional ARP sender hardware address is rewritten, the kernel may attempt to modify a range that has not been made writable. Under particular conditions involving nonlinear socket buffers and splice-imported pages, the write can reach the underlying page.

A local attacker on a host with the relevant bridge rules could use the defect to corrupt memory, crash the machine or potentially elevate privileges. The upstream correction ensures the ARP address range is writable before the header is read and altered.

The third issue, CVE-2025-39964, is a race condition in the AF_ALG cryptographic interface. Concurrent writes to the same socket may interleave, leaving internal state inconsistent. Its 7.8 CVSS score reflects a local, low-privilege path with potentially serious consequences. The fix gives one writer exclusive ownership of the send operation.

Patching must be paired with investigation

Organizations should install vendor-supplied kernel updates, reboot into the repaired kernel and confirm which build is actually running. Simply placing a new package on disk is insufficient if the vulnerable kernel remains active. Where an update cannot yet be deployed, defenders should evaluate vendor mitigations or retire unsupported products.

• Preserve useful logs and telemetry before remediation changes the system state.
• Review exposed hosts for kernel crashes, unexplained privilege changes and unusual namespace activity.
• Look for unauthorized netfilter modifications and suspicious use of cryptographic interfaces.
• Consider disabling unused kTLS, removing unnecessary ARP-rewriting rules and restricting CAP_NET_ADMIN after assessing operational impact.

Why the deadline matters

The three flaws cover different kernel subsystems and do not present one uniform attack path. That makes accurate asset inventory essential: defenders need to know where kTLS is active, which hosts use bridge filtering rules and whether untrusted users can reach AF_ALG. Internet-facing and multi-user systems deserve particular attention.

CISA’s forensic requirement is the central message. Active exploitation means patching closes the door but cannot reveal whether someone already entered. Teams should treat remediation and compromise assessment as parallel workstreams, escalating any unusual kernel behavior or privilege activity for deeper response. Findings should be correlated across identity, endpoint and network records so subtle evidence is not reviewed in isolation.