CISA KEV adds three unrelated Linux kernel flaws in one day: kTLS receive-path logic error, AF_ALG race condition, netfilter ebtables SNAT out-of-bounds write
CISA lists three separate Linux kernel bugs as exploited; Red Hat says public exploits exist, with no account of use
Defender actions
- Patch the kernel ahead of the regular cycle on Linux hosts that load the tls module (CVE-2025-39682, remotely reachable), run ebtables SNAT rules that rewrite ARP hardware addresses on a bridge (CVE-2026-53266), or give less-trusted users local access (all three); where the update must wait, block the tls module from loading or remove the ARP-rewrite SNAT rules, as Red Hat advises.
Analysis
CISA added three unrelated Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on 2026-09-18, in two separate alerts (CISA, 2026-09-18; CISA, 2026-09-18), and neither alert names a ransomware campaign, an actor, or a technical account of the exploitation behind any of the three. The Hacker News reports that Red Hat has since stated of each that "there are known public exploits leveraging this vulnerability" (The Hacker News, 2026-09-19). CVE-2025-39682 is a logic error in the kernel's TLS receive path: a zero-length record taken from the rx_list queue slips past the per-recvmsg() record-type check, a corner case the fix describes as previously unhandled, and Red Hat says it "can be remotely triggered only when kernel TLS (CONFIG_TLS with the TLS ULP) is in use" (Red Hat Product Security, 2026-09-19). CVE-2025-39964 is a race condition in the AF_ALG crypto user-API socket: concurrent sendmsg() calls to the same socket were never given exclusive-write ownership, so request payloads interleave and corrupt per-socket state, which a local user can use to crash the system or corrupt cryptographic results (Red Hat Product Security, 2026-09-19). CVE-2026-53266 is an out-of-bounds write in the netfilter bridge ebtables SNAT target, where the ARP sender-hardware-address rewrite writes directly into a socket-buffer fragment backed by a splice-imported file page (CISA KEV catalog, 2026-09-18); Red Hat rates it Important and says a local attacker on a system with such bridge rules can reach privilege escalation, memory corruption or denial of service (Red Hat Product Security, 2026-09-19). Fixed stable kernels, each confirmed in kernel.org's release ChangeLog: CVE-2025-39682 in 6.1.149, 6.6.103, 6.12.44 and 6.16.4; CVE-2025-39964 in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9; CVE-2026-53266 in 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36 and 7.0.13.
Contradiction: The Hacker News describes CVE-2025-39682 as a flaw that "could allow local authenticated users to trigger memory disclosure or denial-of-service" (The Hacker News, 2026-09-19), whereas Red Hat states it "can be remotely triggered only when kernel TLS (CONFIG_TLS with the TLS ULP) is in use" and scores the attack vector as network (Red Hat Product Security, 2026-09-19). The exposure assessment above follows Red Hat's technical account of the receive path.
Cited evidence
CISA has added one new vulnerability to its
based on evidence of active exploitation
The corner case we missed is when the initial record comes from rx_list, and it's zero length.
Updates3
Red Hat now states that public exploits exist for all three flaws. It updated its advisories for CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266 on 2026-09-19 at 02:00 UTC, saying of each that "This CVE is high risk and there are known public exploits leveraging this vulnerability" and "Address this vulnerability with high priority" (The Hacker News, 2026-09-19). The earlier text stated that no vendor advisory added exploitation detail beyond the fixed kernel builds. How the flaws are being exploited, and whether they are chained, is still not described anywhere.
The severity annotation recorded for CVE-2025-39682 was wrong. Red Hat's own page for the CVE publishes a base score of 7.0 with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H, while NVD and cve.org both publish 9.8 with AV:N/AC:L (Red Hat Product Security). The entry's second figure was recorded as 7.1, attributed to NVD rather than Red Hat, and given an AV:L local attack vector that no authority assigns. The practical consequence was a contradiction: the analysis describes a flaw reachable over the network wherever kernel TLS receive offload terminates TLS, and an AV:L annotation would have told a triage reader the opposite. Only the score annotation changes; the exploitation status, the affected and fixed kernel versions, and the analysis are unchanged.
Red Hat's statement is that public exploits exist, not a confirmation of in-the-wild use: it updated its advisories for all three flaws on 2026-09-19 to say "there are known public exploits leveraging this vulnerability" (The Hacker News, 2026-09-19). The Hacker News describes that update as acknowledging active exploitation, which the quoted wording does not say (The Hacker News, 2026-09-19). No source says which systems or configurations the exploitation used, so no class of Linux host can be ruled out as a target. The ebtables SNAT fix also shipped in the 7.0.13 stable kernel (kernel.org, 2026-06-19).
The Hacker News describes CVE-2025-39682 as reachable by local authenticated users (The Hacker News, 2026-09-19), while Red Hat says it can be triggered remotely where kernel TLS is in use (Red Hat Product Security, 2026-09-19). The two readings conflict, and the exposure assessment follows Red Hat's account of the receive path.
Sources24
Revision history
- Published 2026-09-19T0409Z-intel
- Correction 2026-09-20T1308Z-audit
The sourcing note said no vendor advisory added exploitation detail beyond re-listing fixed kernel builds. Red Hat had already updated its advisories for all three flaws, on 2026-09-19 at 02:00 UTC, to acknowledge active exploitation, state that public exploits exist and tell customers to address them with high priority. The sourcing note and the verification value now reflect that second assessment, and the three NVD API endpoints previously listed as sources are replaced by Red Hat's own per-flaw advisory pages. Two evidence quotes attributed to those endpoints were re-checked: one is carried verbatim by Red Hat's page and is now attributed there, the other is on no reachable first-party page and is removed. The three inline citations in the analysis pointed at the same endpoints and now point at Red Hat's pages; the sentence on the bridge flaw is rewritten to what Red Hat states, because the function name and the page-fragment detail it previously carried are on no source the entry can cite.
Changed: verification sourcing_note sources evidence body
- Correction 2026-09-27T1308Z-audit
The second score recorded for CVE-2025-39682 was wrong in every part. Red Hat's own CVE page scores it 7.0 with vector AV:N/AC:H, not 7.1, and the re-score is Red Hat's rather than NVD's; NVD and cve.org both publish 9.8 with AV:N. No authority scores this flaw AV:L, and the local attack vector the entry recorded contradicted its own analysis, which describes the flaw as reachable over the network on hosts using kernel TLS receive offload. The other two CVEs' score annotations were re-checked against the same authority and are accurate.
Changed: cves
- Correction 2026-09-30T0639Z-audit
The headline, summary and main text said the KEV listing was the only public evidence of exploitation, although Red Hat had stated on 2026-09-19 that public exploits exist. They now carry Red Hat's statement, without claiming Red Hat confirms active exploitation. The takeaway and action no longer claim that general-purpose fleets are not at elevated risk or that three configurations are the only exploited surfaces, the US federal deadline remark and source-file names no cited page carries are removed, and the fixed stable kernels cite kernel.org's ChangeLogs, adding 7.0.13 for CVE-2026-53266. The Hacker News' local reading of CVE-2025-39682 is stated as a contradiction to Red Hat's remote one. CVE-2025-39964 is typed as denial of service, as Red Hat describes it.
Changed: headline summary body title actions cves sourcing_note sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.