AiCybr

CISA Adds Three Linux Kernel Flaws to KEV: Check AF_ALG, ebtables SNAT and kTLS

By AiCybr Editorial · Published September 21, 2026

The U.S. Cybersecurity and Infrastructure Security Agency added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on September 18, 2026: CVE-2025-39964, CVE-2026-53266 and CVE-2025-39682. CISA's catalog gives U.S. Federal Civilian Executive Branch agencies a September 21, 2026 remediation deadline under BOD 26-04.

The three bugs reach different kernel subsystems. CVE-2025-39964 affects concurrent writes through the kernel's AF_ALG cryptographic socket interface. CVE-2026-53266 affects an ebtables SNAT path used for ARP sender-hardware-address rewriting on bridges. CVE-2025-39682 affects Linux kernel TLS handling of zero-length records on the receive list. CISA's KEV entries establish evidence of exploitation for all three.

For operators, the immediate job is to identify the running kernel and the relevant feature exposure, then install the fixed kernel supplied by the distribution and reboot into it. Package versions vary because Linux vendors backport kernel security fixes, so a mainline version number alone is an unreliable patch-status test for enterprise distributions.

Three KEV entries, three different exposure paths

CVE Kernel area Practical exposure check Vendor-scored impact varies
CVE-2025-39964 Crypto / AF_ALG Determine whether untrusted local workloads can use AF_ALG sockets Ubuntu currently scores it 3.3/Low; Linux CNA data has also carried a higher local vector
CVE-2026-53266 Bridge netfilter / ebtables SNAT Look for bridge ebtables SNAT rules that rewrite ARP sender hardware addresses Red Hat scores 7.5; its published vector differs from the Linux CNA vector
CVE-2025-39682 Kernel TLS receive path Identify systems and services using kernel TLS and confirm the distro kernel contains the fix Vendor scores differ; Oracle lists it Important with a local vector

The affected kernel paths and the conditions needed to reach them provide the useful host-level triage signals.

CVE-2025-39964: concurrent AF_ALG writes

CVE-2025-39964 fixes a race in af_alg_sendmsg(). The upstream description says two writes to the same AF_ALG socket can interleave and create inconsistencies in the socket's internal state. The kernel fix adds exclusive ownership for writing so concurrent writers cannot enter that path together.

AF_ALG is the Linux socket interface that exposes kernel cryptographic algorithms to user space. The published attack vectors describe local access. Shared systems, container hosts and machines that run untrusted local code therefore warrant particular attention during triage.

Severity data for this CVE is unusually inconsistent across current records. Ubuntu currently gives it CVSS 3.3 Low and marks supported Ubuntu releases according to its own backported package status, while the Linux CNA record has carried a substantially higher local-impact vector. Operators should use their distribution's advisory to determine whether the installed kernel package is affected.

CVE-2026-53266: ebtables SNAT ARP rewrite

CVE-2026-53266 is in the bridge netfilter ebtables SNAT target. Red Hat describes a memory-safety problem in the optional ARP sender hardware address rewrite: under the affected path, a write can reach a nonlinear socket-buffer fragment before the relevant range has been made writable.

Red Hat rates the flaw Important, CVSS 7.5, and says exploitation requires specific bridge netfilter rules. Its mitigation is concrete: disable ARP hardware-address rewriting in ebtables SNAT rules, or remove ebtables SNAT rules operating on ARP traffic on bridge interfaces until the fixed kernel can be deployed.

That configuration dependency provides a useful triage signal. Systems that actively perform this ARP rewrite deserve priority during the configuration review. Patch status still comes from the distribution's kernel advisory because backports can fix an older-looking kernel release.

CVE-2025-39682: zero-length records in kernel TLS

CVE-2025-39682 fixes handling of zero-length records in the Linux kernel TLS receive path. The upstream Linux CVE announcement describes a corner case involving a record retrieved from rx_list: the receive logic can reach an invalid state when that initial record has zero length.

Oracle rates the issue Important and publishes a local, low-privilege attack vector for its assessment. Multiple stable-kernel branches received upstream fixes, while distribution kernels may carry those fixes under their existing version lines.

Systems using kernel TLS deserve the fastest configuration-level review. Administrators can pair that review with their vendor's package tracker to determine whether the running kernel already contains the backport.

Patch the distribution kernel, then verify the running kernel

A practical response sequence is:

  1. Record the running kernel. Use uname -r or the operating system's inventory tooling on every affected host class.
  2. Check the distribution advisory. RHEL, Ubuntu, Debian, SUSE, Oracle Linux and cloud distributions can backport fixes while retaining their existing kernel version lines.
  3. Prioritize exposed feature paths. Review AF_ALG access on multi-user or untrusted-workload hosts, ebtables SNAT rules on Linux bridges, and kernel-TLS use on applicable services.
  4. Install the vendor-fixed kernel and reboot. Confirm the host is actually running the updated kernel after maintenance; installing a kernel package leaves the previous kernel active until reboot.
  5. Use feature mitigation as an interim control when necessary. Red Hat's ebtables guidance is useful when immediate rebooting is impractical. A vendor-fixed kernel remains the durable remediation.
  6. Review exploitation telemetry according to host role. KEV status raises the incident-response priority for exposed systems, especially shared compute, container infrastructure and systems where untrusted local execution is plausible.

Why the September 21 date matters

The September 21 date in CISA's KEV catalog is the remediation deadline for covered U.S. federal civilian agencies. Private organizations can use KEV inclusion as a strong exploitation-priority signal; their own patch deadlines come from internal risk and compliance requirements.

CISA's public entries focus on the exploited vulnerabilities and remediation requirement. Host triage therefore comes from the specific subsystem involved, the running distribution kernel and the system's actual feature configuration.

Bottom line

Linux operators should handle the three September 18 KEV additions as a kernel patching and exposure-mapping task. Start with the distribution's fixed kernel, verify the rebooted version, and use AF_ALG access, bridge ebtables SNAT configuration and kernel-TLS use to decide which systems need the fastest attention.

Sources

Continue reading

Cybersecurity Linux Kernel CVE-2026-53362 Is in CISA KEV: Patch Container Hosts Now

CVE-2026-53362 is an actively exploited Linux IPv6 fragmentation flaw in CISA KEV. The August 30 federal deadline has passed; here are the container-escape preconditions, distro status and operator actions.

Cybersecurity N-able N-central CVE-2026-86218: CISA KEV Deadline Is September 11

CISA added N-able N-central CVE-2026-86218 to its Known Exploited Vulnerabilities catalog on September 8, 2026. On-premises operators should upgrade to HF4 build 2026.3.1.14; covered U.S. Federal Civilian Executive Branch agencies have a September 11 remediation deadline.

Cybersecurity Citrix NetScaler CVE-2026-8452 Is in CISA KEV: Patch Before August 29

CISA has added Citrix NetScaler CVE-2026-8452 to KEV after confirmed exploitation. Here are the affected Gateway/AAA configurations, fixed builds, RCE evidence boundary and response steps.