3 Linux Kernel Flaws Exploited; CISA Sets Sept. 21 Patch Deadline

CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalogue on 18 September 2026 and set 21 September as the remediation deadline for federal civilian agencies — three days. The additions came in two separate alerts the same day, one covering two flaws and one covering a third.

CVE-2026-53266 is an out-of-bounds write in the ebtables SNAT target in the kernel's bridge netfilter code; CISA's entry says an ARP sender hardware address rewrite can write straight into a nonlinear socket-buffer fragment backed by a splice-imported file page. CVE-2025-39964 is a race condition that lets two concurrent writes hit the same AF_ALG crypto socket, interleaving data unpredictably and leaving the socket's internal state inconsistent. CVE-2025-39682 sits in the TLS receive path, where a zero-length record pulled from the rx_list can bypass recvmsg()'s intended record-type handling.

How severe they are depends on who is doing the rating. kernel.org, the CVE numbering authority for the kernel, scores the ebtables flaw at 8.8, the AF_ALG race at 7.8 and the TLS bug at 9.8, or critical. NIST's National Vulnerability Database, where its analysts have published their own score, is lower: 5.5 for the AF_ALG race and 7.1 for the TLS flaw — and NVD rates the TLS bug as locally exploitable where kernel.org marks it network-reachable. NVD has not issued a score of its own for the ebtables flaw.

CISA's own decision records, timestamped 18 September, list all three as under "active" exploitation with "total" technical impact. Only the TLS flaw is marked automatable, meaning exploitation can be scripted at scale. CISA lists the ransomware status of all three as unknown and names no attacker, campaign or victim.

The fixes themselves are not new. Upstream patches for all three are already in git.kernel.org, and the records reached the NVD on 5 September 2025 (TLS), 13 October 2025 (AF_ALG) and 25 June 2026 (ebtables). Debian's long-term support team issued an advisory on the TLS flaw in October 2025, and Siemens ProductCERT covers two of the three for industrial products. What changed on 18 September is CISA's assertion that attackers are using them. Two of the three entries also carry CISA's note that affected products may be end-of-life.

Three kernel entries in a single day is unusual. The catalogue now holds 1,716 vulnerabilities, 31 of them Linux kernel bugs; by CISA's own feed, 18 September 2026 is only the second date to bring three kernel additions at once, after 15 September 2022. Linux underpins most server and cloud infrastructure, so the exposed population is far larger than the set of agencies actually bound by the deadline.

That deadline comes from Binding Operational Directive 26-04, which applies only to Federal Civilian Executive Branch agencies; CISA urges every other organisation to prioritise catalogue entries on the same basis. The required action goes beyond patching: agencies must also follow CISA's forensics triage guidance and establish whether they were compromised before the fix was applied. CISA has published no indicators of compromise for the three flaws.