Linux kernel

CISA KEV adds three unrelated Linux kernel flaws in one day: kTLS receive-path logic error, AF_ALG race condition, netfilter ebtables SNAT out-of-bounds write

CISA added three unrelated Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on 2026-09-18, in two separate alerts (CISA, 2026-09-18; CISA, 2026-09-18), and neither alert names a ransomware campaign, an actor, or a technical account of the exploitation behind any of the three. The Hacker News reports that Red Hat has since stated of each that "there are known public exploits leveraging this vulnerability" (The Hacker News, 2026-09-19). CVE-2025-39682 is a logic error in the kernel's TLS receive path: a zero-length record taken from the rx_list queue slips past the per-recvmsg() record-type check, a corner case the fix describes as previously unhandled, and Red Hat says it "can be remotely triggered only when kernel TLS (CONFIG_TLS with the TLS ULP) is in use" (Red Hat Product Security, 2026-09-19). CVE-2025-39964 is a race condition in the AF_ALG crypto user-API socket: concurrent sendmsg() calls to the same socket were never given exclusive-write ownership, so request payloads interleave and corrupt per-socket state, which a local user can use to crash the system or corrupt cryptographic results (Red Hat Product Security, 2026-09-19). CVE-2026-53266 is an out-of-bounds write in the netfilter bridge ebtables SNAT target, where the ARP sender-hardware-address rewrite writes directly into a socket-buffer fragment backed by a splice-imported file page (CISA KEV catalog, 2026-09-18); Red Hat rates it Important and says a local attacker on a system with such bridge rules can reach privilege escalation, memory corruption or denial of service (Red Hat Product Security, 2026-09-19). Fixed stable kernels, each confirmed in kernel.org's release ChangeLog: CVE-2025-39682 in 6.1.149, 6.6.103, 6.12.44 and 6.16.4 (CISA KEV catalog, 2026-09-18); CVE-2025-39964 in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9 (CISA KEV catalog, 2026-09-18); CVE-2026-53266 in 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36 and 7.0.13 (CISA KEV catalog, 2026-09-18).

Contradiction: The Hacker News describes CVE-2025-39682 as a flaw that "could allow local authenticated users to trigger memory disclosure or denial-of-service" (The Hacker News, 2026-09-19), whereas Red Hat states it "can be remotely triggered only when kernel TLS (CONFIG_TLS with the TLS ULP) is in use" and scores the attack vector as network (Red Hat Product Security, 2026-09-19). The exposure assessment above follows Red Hat's technical account of the receive path.

CVE-2026-43284 / CVE-2026-43500 Linux Dirty Frag: deterministic page-cache write to root through xfrm-ESP and RxRPC, public exploit, fixes released

Researcher Hyunwoo Kim (V4bel) published "Dirty Frag" on 2026-05-07, after the embargo had been broken by external factors and before patches or CVE ids existed (V4bel, 2026-05-07). It is two page-cache write flaws: CVE-2026-43284 in the xfrm-ESP (IPsec) receive path, in the kernel since 2017 and fixed in mainline commit f4c50a4034e6, and CVE-2026-43500 in RxRPC, in the kernel since 2023 and fixed in mainline commit aa54b1d27fe0 (V4bel, 2026-05-07). In both, a page-cache page planted with splice() sits in a fragment of a network buffer and the receiving code decrypts it in place, writing into the cached copy of a file: the ESP variant stores 4 attacker-chosen bytes per trigger into a setuid binary such as su, and the RxRPC variant stores 8 bytes whose value the attacker brute-forces through the session key, aimed at /etc/passwd; the result is deterministic root without a race window (V4bel write-up, 2026-05-07). The ESP variant needs the privilege to create a user namespace, which Ubuntu sometimes blocks through AppArmor; the RxRPC variant needs no namespace but depends on the rxrpc module, which most distributions do not ship and Ubuntu loads by default (V4bel, 2026-05-07). The kernel.org CNA scores CVE-2026-43284 CVSS 8.8, and NVD and CISA score CVE-2026-43500 7.8 (Ubuntu, 2026-05-08). Microsoft reports limited in-the-wild privilege escalation involving su that "may be indicative of techniques associated with either" Dirty Frag or Copy Fail: an SSH session ran an ELF binary that escalated through su, then edited a GLPI LDAP authentication file and deleted and read web session files (Microsoft Security Blog, 2026-05-08).

The researcher tested the exploit on Ubuntu 24.04.4, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10 and Fedora 44 (V4bel, 2026-05-07). Ubuntu publishes fixed kernels for every supported release from 18.04 to 26.04 (Ubuntu, 2026-05-08), and Red Hat states that fixes are released for all affected products and that CVE-2026-43500 does not affect Red Hat products (Red Hat RHSB-2026-003). Where a fix cannot be applied, NCSC-CH advises blocking or removing the esp4, esp6 and rxrpc modules (NCSC-CH advisory 12547, 2026-05-08), which affects IPsec and AFS where they are in use (Ubuntu, 2026-05-08); on RHEL, user.max_user_namespaces=0 blocks the ESP path (Red Hat RHSB-2026-003). Red Hat notes that, because of its similarities with Copy Fail, Dirty Frag is also called "Copy Fail 2" (Red Hat RHSB-2026-003); Copy Fail is a separate, earlier flaw, CVE-2026-31431 (Microsoft Security Blog, 2026-05-08).

Linux kernel IPv6 UDP fraggap accounting bug (CVE-2026-53362) added to CISA KEV, an unprivileged local heap overflow via MSG_SPLICE_PAGES, no exploitation narrative published

CISA added CVE-2026-53362 to its Known Exploited Vulnerabilities catalog on 2026-08-27. In __ip6_append_data()'s paged-allocation branch (taken under MSG_MORE / NETIF_F_SG / large-fraglen conditions) alloclen and pagedlen accounting fail to account for a non-zero "fraggap" carried over from a previous skb once transhdrlen is zero, undersizing the linear allocation while overstating pagedlen, so the fraggap-copy step writes past skb->end into the trailing skb_shared_info. The upstream fix commit states the trigger directly: "an unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES" (Linux kernel stable-tree fix commit, 2026-08-27). The bad accounting was introduced by an earlier commit ("ipv6: avoid partial copy for zc") and only became reachable once a later commit allowed MSG_SPLICE_PAGES to proceed in the negative-copy case that previously returned -EINVAL. CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

As of 2026-08-28, no public exploitation narrative, named cluster, or affected-distribution list has been located beyond the KEV/EUVD listing and the upstream kernel commit itself; the flaw is confirmed-exploited per CISA's determination, with the mechanism confirmed against the kernel-tree commit. A local, unprivileged-to-elevated primitive requires an attacker to already hold unprivileged local code execution, exactly the scenario a confirmed kernel LPE turns into full compromise.

Because this affects any Linux kernel exposing an unprivileged user to socket operations (effectively all general-purpose Linux deployments pending distribution backport) the patch lever is the standing kernel-update cycle rather than a configuration change. Triage: none is offered beyond the patch action itself; with no published exploitation narrative, inventing a specific hunting query for this primitive would exceed what the cited sources support. The one available lever short of a distribution backport is restricting which local users or containers can open raw UDPv6 sockets with MSG_SPLICE_PAGES-capable applications, which is not a practical general control for most estates.