CISA Flags Three Linux Kernel Flaws as Actively Exploited

The US Cybersecurity and Infrastructure Security Agency added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on September 18, 2026. The entries cover different kernel subsystems: the kernel TLS receive path, the bridge netfilter ebtables SNAT target, and the AF_ALG cryptographic userspace interface.

CISA’s catalog status is the important new fact. These are not merely vulnerabilities that could theoretically be exploited: CISA says there is evidence of active exploitation. All three entries carry a September 21 remediation due date for organizations subject to the agency’s BOD 26-04 requirements, and all three are marked as requiring forensic triage.

The September 21 date comes from CISA’s federal remediation policy; it should not be read as an operating-system-wide expiration date for every Linux PC. Consumer and enterprise distributions ship different kernel versions and frequently backport security fixes without changing to the newest upstream kernel version, so a version number alone is not enough to establish whether a particular installation is vulnerable.

For ordinary Linux users, the practical check is the security status published by the distribution that supplied the kernel. Systems running an unsupported kernel deserve particular attention because CISA explicitly notes that affected products can include end-of-life or end-of-service releases for two of the entries. Installing the distribution’s fixed kernel normally also means making sure the machine actually boots that fixed kernel afterward.

Linux kernel security fixes move through several layers. Upstream stable commits correct the underlying kernel code, but distributions decide which fixes need to be backported into the kernels they support. CISA’s KEV catalog adds another signal: evidence that attackers are actually using a vulnerability. Those three facts answer different questions and should not be collapsed into a single claim that every kernel below some version is unsafe.

Red Hat’s assessments illustrate the configuration dependence. It describes CVE-2025-39682 as a kTLS flaw that can be triggered only when the TLS ULP is in use, offers disabling the tls module as a mitigation, and describes CVE-2026-53266 as dependent on particular bridge netfilter rules. For CVE-2025-39964, Red Hat says preventing the af_alg module from loading can mitigate the issue. Those are vendor-specific mitigations rather than universal instructions for every distribution.

The useful takeaway for PC and server owners is therefore targeted rather than alarmist: because CISA has confirmed exploitation, check your distribution’s advisories for these three CVE identifiers, install the fixed kernel package when your system is affected, and do not assume that an old-looking kernel version is unpatched if your distribution backports security fixes.