# CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities: kTLS Receive-Path Disclosure/DoS, ebtables SNAT Privilege Escalation, and AF_ALG Race Condition (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964)

> CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on September 18, 2026 after Red Hat confirmed known public exploits: a critical kTLS receive-path memory disclosure/DoS flaw (CVE-2025-39682, CVSS 9.8), an ebtables SNAT ARP-rewrite out-of-bounds write enabling local privilege escalation (CVE-2026-53266, CVSS 8.8), and an AF_ALG socket race condition corrupting cryptographic operations (CVE-2025-39964, CVSS 7.8). FCEB agencies face a September 21, 2026 remediation deadline under BOD 26-04.

- **Published:** 2026-09-19T00:00:00Z
- **Last reviewed:** 2026-09-27T21:45:18.493Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2582
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-linux-kernel-kev-flaws-tl-2026-2582.webp?v=3e97eb2a (Threadlinqs threat intel: CVE-2025-39682 Linux Kernel KEV Trio: Detection & IOCs (TL-2026-2582) — Critical severity, 57 IOCs, 9 detection rules.)
- **ID:** TL-2026-2582
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 57 (3 shown free below)
- **CVEs:** CVE-2025-39682, CVE-2026-53266, CVE-2025-39964

## Description

On September 18, 2026, CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after Red Hat updated its security advisories at 02:00 UTC on September 19, 2026 to confirm 'known public exploits' targeting all three flaws. Federal Civilian Executive Branch (FCEB) agencies face a Binding Operational Directive (BOD) 26-04 remediation deadline of September 21, 2026, and CISA's KEV notes require forensic triage of potentially exposed assets rather than patch-only remediation.

CVE-2025-39682 (CVSS 9.8 per the CVE Numbering Authority; NVD separately scores it 7.1 under a local-vector interpretation) is an improper-condition-check flaw (CWE-754) in the Linux kernel's software kernel TLS (kTLS) receive path, in net/tls/tls_sw.c. A zero-length TLS record retrieved from the socket's rx_list bypasses the intended record-type handling in recvmsg(), breaking the invariant that a single receive operation processes either contiguous data records or one non-data record, and leaving subsequent records processed under incorrect zero-copy/queueing assumptions. Because kTLS moves TLS record decryption into the kernel for any TCP socket with TCP_ULP set to 'tls', Red Hat confirms the bug 'can be remotely triggered only when kernel TLS ... is in use' -- making internet-facing services that offload TLS decryption to the kernel remotely exploitable for memory disclosure or denial-of-service. Interim mitigation is blacklisting the tls kernel module (Red Hat solution 41278).

CVE-2026-53266 (CVSS 8.8 per CNA; CWE-825 Expired Pointer Dereference per Red Hat, CWE-787 Out-of-Bounds Write per NVD) affects the netfilter bridge ebtables SNAT target's optional ARP sender-hardware-address (SHA) rewrite path in net/bridge/netfilter/ebt_snat.c. The code safely reads the ARP header with skb_header_pointer() but then calls skb_store_bits() to rewrite the SHA without first verifying the destination range is writable; when that range falls inside a nonlinear socket-buffer fragment backed by a splice-imported file page, the write lands directly on the underlying page. Red Hat's bug tracker (BZ#2485368) attributes the regression to commit 63137bc5882a, which fixed an unrelated small-packet issue but introduced this memory-safety gap, and notes the resulting corruption can extend to file-backed memory, cross-process corruption via vmsplice(), or use-after-free conditions -- consistent with the CNA's CVSS vector recording Scope:Changed. Exploitation requires a local attacker on a system with bridge netfilter rules configured to perform ARP SHA rewriting, and requires CAP_NET_ADMIN capability to configure the ebtables SNAT rule in the first place -- a prerequisite that concentrates real-world risk in container and virtualization hosts using bridge networking, where a namespaced or delegated CAP_NET_ADMIN is common; impact ranges from crash to local privilege escalation, with NVD's Scope:Changed rating reflecting the documented cross-process memory corruption when affected pages are shared via vmsplice(). Red Hat shipped fixes via RHSA-2026:36645 (RHEL 9) and RHSA-2026:39082/RHSA-2026:39083 (RHEL 8); the interim workaround is disabling ARP hardware-address rewriting in ebtables SNAT rules.

CVE-2025-39964 (CVSS 7.8 per CNA; NVD splits this as a 5.5 C:N/I:N vector and a separate 7.8 C:H/I:H vector; CWE-362/CWE-366 Race Condition) is a synchronization flaw in the kernel's AF_ALG cryptographic socket interface (crypto/af_alg.c) that allowed two threads to issue concurrent sendmsg() writes to the same socket, interleaving request payloads unpredictably inside the kernel's crypto processing queue and leaving the per-socket context inconsistent. A local, low-privileged user can trigger a kernel crash or cause corrupted cryptographic operation results -- a data-integrity concern for any application relying on AF_ALG for in-kernel crypto. The fix adds an exclusive write-ownership field (ctx->write) so only one writer can hold the socket at a time; interim mitigation is blacklisting the af_alg module.

All three flaws also appear in Siemens ProductCERT advisories (SSA-032379 for CVE-2025-39682; SSA-019113 for CVE-2025-39964) covering industrial and embedded Linux-based products, extending exposure beyond general-purpose servers into OT/ICS environments. No specific threat actor, malware family, or public IOC set has been attributed to the in-the-wild exploitation; CISA's KEV listing is the operative evidence of active exploitation, and Red Hat's advisory language ('known public exploits') indicates public exploit code exists for at least one of the three flaws.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.005 Exploits
- T1190 Exploit Public-Facing Application
- T1082 System Information Discovery
- T1040 Network Sniffing
- T1611 Escape to Host
- T1499.004 Application or System Exploitation
- T1046 Network Service Discovery
- T1565.003 Runtime Data Manipulation
- T1588.006 Obtain Capabilities
- T1587.004 Develop Capabilities
- T1068 Exploitation for Privilege Escalation
- T0814 Denial of Service
- T0890 Exploitation for Privilege Escalation
- T1212 Exploitation for Credential Access
- T1565.001 Data Manipulation
- T1210 Exploitation of Remote Services
- T0866 Exploitation of Remote Services
- T1106 Native API
- T1546 Event Triggered Execution
- T1211 Exploitation for Stealth
- T1529 System Shutdown/Reboot

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**kTLS Receive-Path Kernel Crash — Zero-Length TLS Record Exploitation (CVE-2025-39682)** (`TL-2026-2582-SPL-001`)

Detects kernel oops/panic/KASAN signatures referencing the kTLS software receive path (net/tls/tls_sw.c, tls_sw_recvmsg) on hosts that offload TLS decryption to the kernel (TCP_ULP=tls). This is the crash/disclosure signature of CVE-2025-39682, a CISA KEV-listed, remotely triggerable improper-condition-check flaw where a zero-length TLS record retrieved from the socket rx_list bypasses record-type handling in recvmsg(), causing memory disclosure or denial-of-service on internet-facing kTLS-offload services.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1046, T1040, T1499.004
- **Data sources:** linux_kernel_syslog, auditd, netflow, device_network_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

````spl
index=linux_servers (sourcetype=syslog OR sourcetype=linux_secure) (facility=kern OR source="/var/log/kern.log" OR source="/var/log/messages")
("tls_sw_recvmsg" OR "net/tls/tls_sw.c" OR ("KASAN" AND "tls") OR ("general protection fault" AND "tls_sw") OR "kernel BUG at net/tls/tls_sw.c")
| rex field=_raw "(?<crash_class>BUG:\s+KASAN[^\n]+|general protection fault[^\n]*|kernel BUG at [^\s]+)"
| eval ktls_signature=if(match(_raw, "(?i)tls_sw_recvmsg|net/tls/tls_sw\.c"), 1, 0)
| where ktls_signature=1
``` correlate with prior TLS-offload service exposure recon on the same host in the preceding 15 minutes ```
| join type=left host
    [ search index=network_flows sourcetype=netflow dest_port IN (443, 8443, 993, 995) earliest=-15m
      | stats count as tls_port_probes dc(src_ip) as distinct_scanners by host ]
| stats count as crash_events min(_time) as first_seen max(_time) as last_seen values(crash_class) as crash_signatures values(tls_port_probes) as prior_port_probes by host
| where crash_events>=1
| eval severity=if(prior_port_probes>0, "critical_likely_remote_exploit", "critical_crash_confirmed")
| table host, crash_events, first_seen, last_seen, crash_signatures, prior_port_probes, severity
````

### Microsoft KQL

```kql
let KernelCrashes = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType in ("KernelPanic", "KernelError", "LinuxKernelLog")
| where AdditionalFields has_any ("tls_sw_recvmsg", "net/tls/tls_sw.c", "KASAN")
| extend CrashSignature = extract(@"(BUG: KASAN[^\r\n]+|general protection fault[^\r\n]*|kernel BUG at [^\s]+)", 1, tostring(AdditionalFields))
| where AdditionalFields has "tls_sw_recvmsg" or AdditionalFields has "net/tls/tls_sw.c";
let TlsPortProbes = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (443, 8443, 993, 995)
| summarize ProbeCount = count(), DistinctSources = dcount(RemoteIP) by DeviceId, bin(Timestamp, 15m);
KernelCrashes
| join kind=leftouter (TlsPortProbes) on DeviceId
| summarize CrashEvents = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), CrashSignatures = make_set(CrashSignature), PriorProbes = sum(ProbeCount) by DeviceId, DeviceName
| where CrashEvents >= 1
| extend Severity = iff(PriorProbes > 0, "critical_likely_remote_exploit", "critical_crash_confirmed")
| project DeviceName, DeviceId, CrashEvents, FirstSeen, LastSeen, CrashSignatures, PriorProbes, Severity
```

### Sigma

```yaml
title: Linux Kernel kTLS Receive-Path Crash (CVE-2025-39682)
id: b7f2c9a4-3d1e-4a6b-8c5f-2e9d7a1b4c60
status: experimental
description: Detects kernel panic/oops/KASAN signatures in the software kTLS receive path (net/tls/tls_sw.c, tls_sw_recvmsg), the crash indicator for the CVE-2025-39682 zero-length TLS record disclosure/DoS flaw on kTLS-offload-enabled services.
references:
  - https://access.redhat.com/security/cve/cve-2025-39682
  - https://bugzilla.redhat.com/show_bug.cgi?id=2393511
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-19
tags:
  - attack.initial-access
  - attack.t1190
  - attack.discovery
  - attack.t1046
  - attack.credential-access
  - attack.t1040
  - attack.impact
  - attack.t1499.004
  - cve.2025.39682
logsource:
  product: linux
  service: kernel
detection:
  selection_signature:
    message|contains:
      - 'tls_sw_recvmsg'
      - 'net/tls/tls_sw.c'
  selection_crash:
    message|contains:
      - 'BUG: KASAN'
      - 'general protection fault'
      - 'kernel BUG at'
  condition: selection_signature and selection_crash
falsepositives:
  - Kernel fuzzing/syzkaller test infrastructure intentionally exercising the kTLS receive path
  - Legitimate kernel debugging with CONFIG_DEBUG_TLS or KASAN instrumentation enabled in non-production builds
level: critical
```

**Known false positives:**

- Kernel fuzzing/syzkaller harnesses intentionally driving the kTLS receive path
- Debug/KASAN-instrumented non-production kernel builds logging benign kTLS warnings

**Tuning notes:** Scope the netflow/DeviceNetworkEvents join to hosts confirmed to have CONFIG_TLS/TCP_ULP=tls kTLS offload enabled (cross-reference against an asset inventory of kTLS-consuming services) to cut noise from unrelated TLS-terminating hosts; widen the join lookback window past 15m in high-latency scan environments.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- kTLS Receive-Path [indicator] Crash — Zero-Length [indicator] Record Exploitation (CVE-2025-39682) (locked: unlock with TL Creds)
- ebtables SNAT ARP Sender-Hardware-Address Rewrite Privilege Escalation Attempt (CVE-2026-53266) (locked: unlock with TL Creds)
- [indicator] Vulnerability Recon Followed by [indicator] Concurrent-Write Race Exploitation (CVE-2025-39964) (locked: unlock with TL Creds)
- kTLS Receive-Path [indicator] Crash — Zero-Length [indicator] Record Exploitation (CVE-2025-39682) (locked: unlock with TL Creds)
- ebtables SNAT ARP Sender-Hardware-Address Rewrite Privilege Escalation Attempt (CVE-2026-53266) (locked: unlock with TL Creds)
- [indicator] Vulnerability Recon Followed by [indicator] Concurrent-Write Race Exploitation (CVE-2025-39964) (locked: unlock with TL Creds)
- ebtables SNAT ARP Sender-Hardware-Address Rewrite Privilege Escalation Attempt (CVE-2026-53266) (locked: unlock with TL Creds)
- [indicator] Vulnerability Recon Followed by [indicator] Concurrent-Write Race Exploitation (CVE-2025-39964) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 57)

Defanged, TLP:CLEAR.

- URL: `hxxps://github[.]com/n1k0oowang/CVE-2025-39964_EXP`
- File hash: `2902c3ebcca52ca845c03182000e8d71d3a5196f`
- URL: `hxxps://github[.]com/suominen/CVE-2025-39964`

Full set of 57 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild](https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CVE-2025-39682 - Red Hat Customer Portal](https://access.redhat.com/security/cve/cve-2025-39682)
- [CVE-2026-53266 - Red Hat Customer Portal](https://access.redhat.com/security/cve/cve-2026-53266)
- [CVE-2025-39964 - Red Hat Customer Portal](https://access.redhat.com/security/cve/cve-2025-39964)
- [NVD CVE-2025-39682 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-39682)
- [NVD CVE-2026-53266 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-53266)
- [NVD CVE-2025-39964 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-39964)
- [Red Hat Bugzilla 2485368 - ebtables SNAT ARP hardware-address rewrite writes to shared memory pages](https://bugzilla.redhat.com/show_bug.cgi?id=2485368)
- [Red Hat Bugzilla 2393511 - kTLS receive-path zero-length record handling](https://bugzilla.redhat.com/show_bug.cgi?id=2393511)
- [Red Hat Bugzilla 2403545 - AF_ALG concurrent socket write race](https://bugzilla.redhat.com/show_bug.cgi?id=2403545)
- [linux-cve-announce: CVE-2025-39682](https://lore.kernel.org/linux-cve-announce/2025090545-CVE-2025-39682-ddab@gregkh/T)
- [linux-cve-announce: CVE-2026-53266](https://lore.kernel.org/linux-cve-announce/2026062517-CVE-2026-53266-6162@gregkh/T/#u)
- [linux-cve-announce: CVE-2025-39964](https://lore.kernel.org/linux-cve-announce/2025101334-CVE-2025-39964-7964@gregkh/T)
- [CISA Warns of Linux Kernel Vulnerabilities Actively Exploited in Attacks](https://cybersecuritynews.com/linux-kernel-vulnerabilities-actively-exploited/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2582