CISA added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities catalog on 18 September 2026, citing active exploitation. CVE-2025-39682 (CVSS 3.1 9.8 Critical, Linux kernel CNA): improper check in the TLS receive path — zero-length records on rx_list can bypass intended recvmsg() record-type handling. CVE-2026-53266 (CVSS 3.1 8.8, Linux kernel CNA): out-of-bounds write in ebtables SNAT ARP rewrite path.

CVE-2025-39964 (CVSS 3.1 7.8, Linux kernel CNA; NVD scores it 5.5, according to Red Hat's CVE page): AF_ALG race allowing concurrent writes to the same crypto socket, leaving inconsistent socket state (CWE-362).

UPDATE 25 September 2026 — IDNsec / Muhammad Alifa Ramdhan (STAR Labs; kernelCTF US$113,337): retrospective shows CVE-2025-39964 can escalate a local user to root and escape a Docker container via scatterlist/usercopy oracle → core_pattern overwrite. Upstream fix adds exclusive write ownership on af_alg_sendmsg. The kernel CNA's CVE record lists the first fixed stable releases as 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9, and 6.17 (distribution kernels may carry the fix under other version numbers).

CISA BOD 26-04 FCEB due 21 September 2026; ransomware use Unknown; forensic triage required. Distinct from DirtyAH6/PPPoEject/TUNderflow/DiagSpill local-root quartet. (sources: CISA KEV; IDNsec)

Correction (29 Oct 2026): the fixed kernel versions came from a Cybersecurity News report that is not linked and were each one release too high; they now follow the Linux kernel CNA's CVE record. The CVSS scores were credited to NVD but are the kernel CNA's; NVD scores CVE-2025-39964 at 5.5, according to Red Hat. The unlinked Cybersecurity News reference was removed. (source: CVE.org (Linux kernel CNA); Red Hat)