Linux Kernel netfilter bridge ebtables SNAT ARP-rewrite out-of-bounds write, CISA KEV 2026-09-18, local

CISA KEV adds three unrelated Linux kernel flaws in one day, kTLS receive-path logic error, AF_ALG race condition, netfilter ebtables SNAT out-of-bounds write

CISA added three unrelated Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on 2026-09-18, in two separate alerts (CISA, 2026-09-18; CISA, 2026-09-18), and neither alert names a ransomware campaign, an actor, or a technical account of the exploitation behind any of the three; the KEV listing itself is the only public evidence that any of them has been used against a real target. CVE-2025-39682 is a logic error in the kernel's TLS receive path (net/tls/tls_sw.c): a peer on a connection using kernel TLS offload for receive can supply a record sequence where the initial record picked up from the socket's rx_list queue is itself zero-length, a corner case the fix commit describes as previously unhandled (NVD/NIST, mirroring the kernel fix commit), reachable only on hosts that terminate TLS using CONFIG_TLS receive offload, an uncommon but real configuration on high-throughput TLS-terminating proxies and some storage or network appliances, not a default on general-purpose servers or workstations. CVE-2025-39964 is a race condition in the AF_ALG crypto user-API socket (crypto/af_alg.c): concurrent sendmsg() calls to the same socket were never given exclusive-write ownership, letting request payloads interleave and corrupt per-socket state (NVD/NIST, mirroring the kernel fix commit); this requires local access to an AF_ALG socket, which is often restricted or entirely unloaded. CVE-2026-53266 is an out-of-bounds write in the netfilter bridge ebt_snat target: the optional ARP sender-hardware-address rewrite calls skb_store_bits() without first confirming the target range is writable, and when that range sits in a nonlinear socket-buffer fragment backed by a splice-imported file page, the write lands directly on the underlying page rather than a copy (NVD/NIST, mirroring the kernel fix commit); this requires a bridge configured with ebtables SNAT ARP-rewrite rules, plus local low-privilege access to trigger it. Fixed kernel builds: 6.1.149 / 6.6.103 / 6.12.44 / 6.16.4 / 6.17 for CVE-2025-39682; 5.10.245 / 5.15.194 / 6.1.154 / 6.6.108 / 6.12.49 / 6.16.9 for CVE-2025-39964; 5.10.259 / 5.15.210 / 6.1.176 / 6.6.143 / 6.12.94 / 6.18.36 for CVE-2026-53266.