CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities: kTLS Receive-Path Disclosure/DoS, ebtables SNAT Privilege Escalation, and AF_ALG Race Condition (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964)

CISA Flags Three Actively Exploited Linux Kernel (TL-2026-2582) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-09-19. It has no confirmed attribution, affects Linux Linux Kernel -- kTLS / net/tls receive path, references 3 CVEs (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964), maps to 13 MITRE ATT&CK techniques (T0814, T1040, T1046), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-2582

Threat ID
TL-2026-2582
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-19
Last reviewed
2026-09-19
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, industrial, critical infrastructure, technology
Target regions
North America, Global
Detection rules
9
Indicators of compromise
28
Updates
2026-09-19 · revalidated 1× · latest source

CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on September 18, 2026 after Red Hat confirmed known public exploits: a critical kTLS receive-path memory disclosure/DoS flaw (CVE-2025-39682, CVSS 9.8), an ebtables SNAT ARP-rewrite out-of-bounds write enabling local privilege escalation (CVE-2026-53266, CVSS 8.8), and an AF_ALG socket race condition corrupting cryptographic operations (CVE-2025-39964, CVSS 7.8). FCEB agencies face a September 21, 2026 remediation deadline under BOD 26-04.

How CISA Flags Three Actively Exploited Linux Kernel works

On September 18, 2026, CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after Red Hat updated its security advisories at 02:00 UTC on September 19, 2026 to confirm 'known public exploits' targeting all three flaws. Federal Civilian Executive Branch (FCEB) agencies face a Binding Operational Directive (BOD) 26-04 remediation deadline of September 21, 2026, and CISA's KEV notes require forensic triage of potentially exposed assets rather than patch-only remediation.

CVE-2025-39682 (CVSS 9.8 per the CVE Numbering Authority; NVD separately scores it 7.1 under a local-vector interpretation) is an improper-condition-check flaw (CWE-754) in the Linux kernel's software kernel TLS (kTLS) receive path, in net/tls/tls_sw.c. A zero-length TLS record retrieved from the socket's rx_list bypasses the intended record-type handling in recvmsg(), breaking the invariant that a single receive operation processes either contiguous data records or one non-data record, and leaving subsequent records processed under incorrect zero-copy/queueing assumptions. Because kTLS moves TLS record decryption into the kernel for any TCP socket with TCP_ULP set to 'tls', Red Hat confirms the bug 'can be remotely triggered only when kernel TLS ... is in use' -- making internet-facing services that offload TLS decryption to the kernel remotely exploitable for memory disclosure or denial-of-service. Interim mitigation is blacklisting the tls kernel module (Red Hat solution 41278).

CVE-2026-53266 (CVSS 8.8 per CNA; CWE-825 Expired Pointer Dereference per Red Hat, CWE-787 Out-of-Bounds Write per NVD) affects the netfilter bridge ebtables SNAT target's optional ARP sender-hardware-address (SHA) rewrite path in net/bridge/netfilter/ebt_snat.c. The code safely reads the ARP header with skb_header_pointer() but then calls skb_store_bits() to rewrite the SHA without first verifying the destination range is writable; when that range falls inside a nonlinear socket-buffer fragment backed by a splice-imported file page, the write lands directly on the underlying page. Red Hat's bug tracker (BZ#2485368) attributes the regression to commit 63137bc5882a, which fixed an unrelated small-packet issue but introduced this memory-safety gap, and notes the resulting corruption can extend to file-backed memory, cross-process corruption via vmsplice(), or use-after-free conditions -- consistent with the CNA's CVSS vector recording Scope:Changed. Exploitation requires a local attacker on a system with bridge netfilter rules configured to perform ARP SHA rewriting, and requires CAP_NET_ADMIN capability to configure the ebtables SNAT rule in the first place -- a prerequisite that concentrates real-world risk in container and virtualization hosts using bridge networking, where a namespaced or delegated CAP_NET_ADMIN is common; impact ranges from crash to local privilege escalation, with NVD's Scope:Changed rating reflecting the documented cross-process memory corruption when affected pages are shared via vmsplice(). Red Hat shipped fixes via RHSA-2026:36645 (RHEL 9) and RHSA-2026:39082/RHSA-2026:39083 (RHEL 8); the interim workaround is disabling ARP hardware-address rewriting in ebtables SNAT rules.

CVE-2025-39964 (CVSS 7.8 per CNA; NVD splits this as a 5.5 C:N/I:N vector and a separate 7.8 C:H/I:H vector; CWE-362/CWE-366 Race Condition) is a synchronization flaw in the kernel's AF_ALG cryptographic socket interface (crypto/af_alg.c) that allowed two threads to issue concurrent sendmsg() writes to the same socket, interleaving request payloads unpredictably inside the kernel's crypto processing queue and leaving the per-socket context inconsistent. A local, low-privileged user can trigger a kernel crash or cause corrupted cryptographic operation results -- a data-integrity concern for any application relying on AF_ALG for in-kernel crypto. The fix adds an exclusive write-ownership field (ctx->write) so only one writer can hold the socket at a time; interim mitigation is blacklisting the af_alg module.

All three flaws also appear in Siemens ProductCERT advisories (SSA-032379 for CVE-2025-39682; SSA-019113 for CVE-2025-39964) covering industrial and embedded Linux-based products, extending exposure beyond general-purpose servers into OT/ICS environments. No specific threat actor, malware family, or public IOC set has been attributed to the in-the-wild exploitation; CISA's KEV listing is the operative evidence of active exploitation, and Red Hat's advisory language ('known public exploits') indicates public exploit code exists for at least one of the three flaws.

MITRE ATT&CK techniques used in TL-2026-2582

Inhibit Response Function

T0814 Denial of Service

Credential Access

T1040 Network Sniffing

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1611 Escape to Host

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1499.004 Application or System Exploitation; T1565.003 Runtime Data Manipulation

Resource Development

T1587.004 Develop Capabilities; T1588.005 Exploits; T1588.006 Obtain Capabilities

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in CISA Flags Three Actively Exploited Linux Kernel

  • Linux — Linux Kernel -- kTLS / net/tls receive path
    Vulnerable versions: Upstream kernel versions with CONFIG_TLS software kTLS support predating the tls_sw.c rx_list fix
    Fixed in: Kernel versions incorporating the upstream tls_sw.c fix commits referenced in the NVD record for CVE-2025-39682
  • Linux — Linux Kernel -- netfilter bridge ebtables SNAT (ebt_snat.c)
    Vulnerable versions: Kernel versions containing commit 63137bc5882a, which introduced the unchecked skb_store_bits() ARP SHA rewrite regression
    Fixed in: RHEL 9 via RHSA-2026:36645; RHEL 8 via RHSA-2026:39082 and RHSA-2026:39083; upstream fix commits referenced in the NVD record for CVE-2026-53266
  • Linux — Linux Kernel -- AF_ALG crypto socket interface (crypto/af_alg.c)
    Vulnerable versions: Kernel versions predating the ctx->write exclusive-ownership fix for concurrent sendmsg() writers
    Fixed in: Kernel versions incorporating the upstream af_alg.c fix commits referenced in the NVD record for CVE-2025-39964
  • Red Hat — Red Hat Enterprise Linux 8
    Vulnerable versions: RHEL 8 kernel packages prior to the patched errata
    Fixed in: Per RHSA-2026:39082 and RHSA-2026:39083 (CVE-2026-53266)
  • Red Hat — Red Hat Enterprise Linux 9
    Vulnerable versions: RHEL 9 kernel packages prior to the patched errata
    Fixed in: Per RHSA-2026:36645 (CVE-2026-53266)
  • Siemens — Industrial/embedded products using affected Linux kernel versions (Siemens ProductCERT SSA-032379, SSA-019113)
    Vulnerable versions: Products bundling affected Linux kernel versions per Siemens ProductCERT advisories
    Fixed in: Per Siemens ProductCERT remediation guidance in SSA-032379 (CVE-2025-39682) and SSA-019113 (CVE-2025-39964)

Remediation for CISA Flags Three Actively Exploited Linux Kernel

Patches

  • RHSA-2026:36645 (RHEL 9, CVE-2026-53266)
  • RHSA-2026:39082 and RHSA-2026:39083 (RHEL 8, CVE-2026-53266)
  • Upstream kernel fix commits for CVE-2025-39682 (net/tls/tls_sw.c) and CVE-2025-39964 (crypto/af_alg.c), backported via distribution stable-kernel updates

Immediate actions

  • Apply Red Hat kernel updates per RHSA-2026:36645 (RHEL 9) addressing CVE-2026-53266
  • Apply Red Hat kernel updates per RHSA-2026:39082 and RHSA-2026:39083 (RHEL 8) addressing CVE-2026-53266
  • Blacklist the tls kernel module (modprobe -r tls) pending patch deployment for CVE-2025-39682, per Red Hat solution 41278
  • Blacklist the af_alg kernel module (modprobe -r af_alg) pending patch deployment for CVE-2025-39964
  • Disable ARP sender-hardware-address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces, to mitigate CVE-2026-53266

Workarounds

  • Blacklist the tls and af_alg kernel modules on systems where kTLS/AF_ALG are unused
  • Remove or reconfigure ebtables SNAT rules that perform ARP sender-hardware-address rewriting on bridge interfaces

Longer-term hardening

  • Track CISA KEV additions against BOD 26-04 remediation deadlines as part of routine patch governance
  • Conduct forensic triage on FCEB and exposed assets per CISA KEV notes to check for evidence of prior exploitation rather than relying on patching alone
  • Restrict kernel TLS (kTLS) offload configuration to services that genuinely require it, reducing the CVE-2025-39682 remote attack surface
  • Audit bridge netfilter/ebtables SNAT ARP-rewrite configurations across containerized and virtualized Linux fleets, since the ebt_snat.c flaw's Scope:Changed rating implies potential cross-boundary (e.g., container) impact

CVEs associated with CISA Flags Three Actively Exploited Linux Kernel

CVE-2025-39682, CVE-2026-53266, CVE-2025-39964

Weaknesses (CWE) in CISA Flags Three Actively Exploited Linux Kernel

CWE-754, CWE-825, CWE-787, CWE-362, CWE-366

Timeline of CISA Flags Three Actively Exploited Linux Kernel

  • Linux kernel CVE announcement bot discloses CVE-2025-39682 (kTLS receive-path zero-length record handling flaw) via the linux-cve-announce mailing list.
  • Debian LTS security team publishes an announcement addressing CVE-2025-39682 for Debian long-term-support kernel packages.
  • Debian's LTS team ships the fix for CVE-2025-39964 (distinct from the 2025-10-01 Debian advisory already on record for CVE-2025-39682) as part of a 470+-CVE linux-6.1 security update for Debian 11 (bullseye), package version 6.1.153-1~deb11u1.
  • Linux kernel CVE announcement bot discloses CVE-2025-39964 (AF_ALG concurrent-write race condition) via the linux-cve-announce mailing list.
  • Siemens publishes SSA-032379 for SIMATIC CN 4100 (firmware before V5.0), a ~159-CVE bundle that includes the fix for CVE-2025-39682.
  • CISA issues Binding Operational Directive 26-04, 'Prioritizing Security Updates Based on Risk,' establishing the risk-tiered patching framework (including a 3-day window for the highest-risk tier) under which these three CVEs were later scoped.
  • Linux kernel CVE announcement bot discloses CVE-2026-53266 (ebtables SNAT ARP sender-hardware-address rewrite out-of-bounds write) via the linux-cve-announce mailing list.
  • Siemens publishes SSA-019113 for the additional GNU/Linux subsystem in specific SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP models, a 240+-CVE bundle that includes CVE-2025-39964.
  • Siemens updates SSA-019113; CVE-2025-39964 remains without an available fix on the affected SIMATIC S7-1500 GNU/Linux subsystem.
  • CISA publishes a public KEV alert bulletin naming only CVE-2025-39964 and CVE-2026-53266; CVE-2025-39682 carries the same date-added/due-date fields in the KEV data feed but is absent from this specific bulletin post -- a catalog-feed-vs-bulletin discrepancy defenders reconciling BOD 26-04 scope should note.
  • CISA adds CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to the Known Exploited Vulnerabilities catalog under Binding Operational Directive 26-04, citing active exploitation.
  • Secondary press (The Hacker News, Cyber Security News) quotes an updated Red Hat advisory claiming known public exploits for CVE-2025-39964 and CVE-2026-53266; this research's direct review of Red Hat's own CVE pages could not independently corroborate that statement, so it should be treated as sourced-but-unverified.
  • The Hacker News publishes a report on the CISA KEV addition and Red Hat's confirmation of active exploitation.
  • Red Hat updates its security advisories for all three CVEs at 02:00 UTC, stating each is 'high risk' with 'known public exploits' leveraging the vulnerabilities.
  • BOD 26-04 remediation deadline for FCEB agencies to patch, mitigate, or discontinue use of affected systems and complete forensic triage.

Update history for TL-2026-2582

Sources cited for CISA Flags Three Actively Exploited Linux Kernel

More in vulnerability

Detection coverage for TL-2026-2582

As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2582 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats