CISA Urges Urgent Patching for Actively Exploited Linux Kernel Vulnerabilities

• •CISA mandates patching for three critical Linux kernel vulnerabilities by September 21, 2026.
• •CVE-2025-39682 has a CVSS score of 9.8, indicating severe risk due to improper condition checks.
• •Forensic investigation is required for affected systems to assess potential compromises.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged three Linux kernel vulnerabilities as actively exploited, requiring federal agencies to patch them by September 21, 2026. The vulnerabilities, CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, were added to CISA's Known Exploited Vulnerabilities catalog on September 18, 2026. CVE-2025-39682, with a CVSS score of 9.8, involves a critical flaw in the TLS receive path that can lead to severe exploitation. CVE-2026-53266 is an out-of-bounds write vulnerability in the netfilter bridge ebtables, while CVE-2025-39964 is a race condition affecting AF_ALG sockets. All three vulnerabilities require forensic triage to investigate potential compromises. The urgency is underscored by the low remediation rates for previous vulnerabilities, with only 26% fully remediated in 2025. Organizations using Linux kernel versions 6.0 to 6.16.3 are particularly at risk.