The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical alert regarding the active exploitation of three significant Linux kernel vulnerabilities. These include CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, which have been added to the Known Exploited Vulnerabilities catalog as of September 18, 2026. Organizations are mandated to address these vulnerabilities by September 21 under the Binding Operational Directive 26-04.

Each vulnerability presents a distinct threat. CVE-2025-39682, with a CVSS score of 9.8, is a critical flaw in the Transport Layer Security (TLS) receive path of the Linux kernel. This vulnerability can allow improper handling of zero-length records, potentially leading to serious security breaches in systems where kernel TLS is enabled. CVE-2026-53266, rated at 8.8, is an out-of-bounds write vulnerability in the netfilter bridge ebtables SNAT target, which can be exploited to cause memory corruption or privilege escalation. Lastly, CVE-2025-39964 involves a race condition in the AF_ALG cryptographic interface, scoring 7.8 on the CVSS scale, and poses a risk of inconsistent internal states during concurrent writes.

CISA emphasizes that the inclusion of these vulnerabilities in the KEV catalog indicates confirmed exploitation in the wild, although specific attackers, victims, or methods have not been disclosed. Consequently, all organizations using affected Linux systems must prioritize patching or applying vendor-specific mitigations to protect their infrastructure.

In addition to installing the necessary patches, CISA advises organizations to conduct thorough forensic investigations to identify any signs of compromise. This involves examining systems for indicators such as kernel crashes, unauthorized changes, or unexpected network activities. For systems where patches are not yet available, temporary measures like disabling unused functionalities or restricting certain capabilities may be necessary to mitigate potential risks.