+91 80401 38000sales@servergurus.com24/7 Expert Support
support@servergurus.comClient Portal →
ServerGurus
← All posts
SecurityCVELinuxInfrastructureHosting

CISA Put Three Linux Kernel Bugs on a 3-Day Clock - Here's the Patch Floor

By ServerGurus Team30 September 20269 min read
CISA Put Three Linux Kernel Bugs on a 3-Day Clock - Here's the Patch Floor

The Situation

On September 18, 2026, CISA added three Linux kernel CVEs to the Known Exploited Vulnerabilities catalog, based on evidence of active exploitation. Federal civilian agencies got a September 21, 2026 due date - three calendar days, over a weekend, under BOD 26-04. That due date has already passed. The catalog entry is still live (CISA KEV feed catalogVersion 2026.09.29, fetched 2026-09-30).

The three IDs, in two CISA alerts published the same day:

  • CVE-2025-39682 - kTLS receive path. CISA: "Improper Check for Unusual or Exceptional Conditions." NVD CVSS 3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
  • CVE-2026-53266 - ebtables SNAT ARP rewrite. CISA: out-of-bounds write into a nonlinear socket-buffer fragment. NVD CVSS 3.1 8.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
  • CVE-2025-39964 - AF_ALG concurrent writes. CISA: race on the same crypto socket. NVD CVSS 3.1 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Known ransomware campaign use: Unknown on all three. CISA did not name an actor, a campaign, or a volume. Do not invent one.

A kernel KEV is not a panel CVE. There is no lsup.sh one-liner. The unit of work is inventory the running kernel, apply the distro floor, reboot (or livepatch), then look for prior compromise because BOD 26-04 also asks whether someone used the hole before you closed it.

What each bug actually is

These descriptions are from the kernel commit messages (mirrored by NVD, Ubuntu, Debian, Red Hat). They are not exploit writeups. CISA's confirmation of exploitation does not include a public technical analysis of how it is being used.

CVE-2025-39682 - kTLS, zero-length record on rx_list

Kernel commit: tls: fix handling of zero-length records on the rx_list (62708b9452f8eb77513115b17c4f8d1a22ebf843, 6.17-rc3). A recvmsg() call is supposed to process either contiguous DATA records or a single non-DATA record. A zero-length record already sitting on rx_list could skip the intended record-type handling, so later TLS records were processed under the wrong zero-copy / queue assumptions.

NVD's 9.8 is network, unauthenticated. That vector only matters on hosts that actually attach kernel TLS to a TCP socket. Ubuntu scored the same 9.8 but tagged priority medium. Debian's tracker marks bullseye not affected ("Vulnerable code not present") and bookworm fixed at 6.1.153-1. Ubuntu jammy is not-affected; noble is released at 6.8.0-86.87.

CVE-2026-53266 - ebtables SNAT writes into a splice-backed page

Kernel commit: netfilter: bridge: make ebt_snat ARP rewrite writable (67ba971ae02514d85818fe0c32549ab4bfa3bf49, 7.1-rc7). The optional ARP sender-hardware-address rewrite in the ebtables SNAT target called skb_store_bits() without first making that range writable. If the bytes lived in a nonlinear fragment backed by a splice-imported file page, the MAC rewrite landed in the file page.

NVD: local, low privilege, changed scope, 8.8. Red Hat's own score is 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) and they call it Important, with a mitigation: disable ARP hardware-address rewriting in ebtables SNAT rules, or remove those rules on bridge interfaces. Ubuntu: high / 8.8. This is the one still pending on Ubuntu 22.04 and 24.04 generic kernels as of the tracker fetch for this post.

CVE-2025-39964 - two writers on one AF_ALG socket

Kernel commit: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (1b34cbbf4f011a121ef7b2d7d6e6920a036d5285, 6.17-rc7). Two writes to the same AF_ALG socket interleaved data and could leave the socket's internal crypto state inconsistent. The fix is exclusive write ownership (ctx->write).

NVD: local 7.8. Ubuntu's tracker lists CVSS 3.1 5.5 and still marks priority high because it is in KEV - that is Ubuntu's own note, not NVD. Do not collapse those two numbers.

Version floors (vendor trackers, 2026-09-30)

Debian (security-tracker.debian.org, fetched 2026-09-30):

CVE bullseye bookworm trixie
CVE-2025-39682 not affected 6.1.153-1 (DSA-6009-1) 6.12.48-1 (DSA-6008-1)
CVE-2026-53266 5.10.259-1 (DLA-4664-1) 6.1.176-1 6.12.94-1
CVE-2025-39964 5.10.247-1 (DLA-4404-1) 6.1.158-1 (DSA-6053-1) 6.12.57-1

If you are on current bookworm/trixie security kernels (6.1.176+ / 6.12.94+), Debian says all three are in the tree. Confirm the running kernel, not the package sitting on disk.

Ubuntu (ubuntu.com/security/cves/*.json, fetched 2026-09-30) for source package linux:

CVE 22.04 jammy 24.04 noble 26.04 resolute
CVE-2025-39682 not-affected released 6.8.0-86.87 not-affected
CVE-2026-53266 pending 5.15.0-198.208 pending 6.8.0-146.146 released 7.0.0-31.31
CVE-2025-39964 released 5.15.0-164.174 released 6.8.0-90.91 not-affected

That middle row is the operator problem. USN-8726-1 (7 September 2026) does list CVE-2026-53266, but the packages it ships for 24.04 are the HWE 7.0 images (linux-image-7.0.0-31-generic 7.0.0-31.31~24.04.1 and friends), not the default 6.8 generic kernel. The tracker still shows linux on jammy/noble as pending. Cloud flavors (linux-aws, linux-gcp, linux-azure, linux-kvm on jammy/noble) were also pending in the same fetch.

Treat the Ubuntu CVE JSON as the live floor. Re-check it before you close a ticket - "pending" today can flip without a blog post.

CloudLinux / Alma / cPanel boxes: this post does not invent a CloudLinux errata ID. Map the running uname -r to the Debian/RHEL clone you actually track, or to KernelCare's kcarectl --patch-info. Older CL7/CL8 3.10/4.18 lines are outside the kTLS code Debian called "not present" on bullseye; they are not automatically outside CVE-2026-53266 or CVE-2025-39964. Check the vendor.

What to do now

1. Inventory the running kernel, not the marketing version

uname -r
cat /etc/os-release | egrep '^(ID|VERSION_ID)='
# Debian / Ubuntu:
dpkg-query -W -f '${Package} ${Version}\n' 'linux-image-*' | grep -v extra
# RHEL clones:
rpm -q kernel
# KernelCare, if present:
kcarectl --uname
kcarectl --patch-info | egrep 'CVE-2025-39682|CVE-2026-53266|CVE-2025-39964'

Anything below the floor in the tables above is still open for that CVE. A package that is installed but not booted does not count.

2. Patch, then reboot - or livepatch

Debian:

apt-get update
apt-get install --only-upgrade linux-image-amd64
reboot
uname -r

Ubuntu 24.04 still on 6.8 generic: either wait for the pending linux 6.8.0-146.146 (tracker version as of this fetch - do not treat that string as a promise it has shipped) or move to the HWE 7.0 kernel that USN-8726-1 already published, knowing that is a kernel-series change, not a quiet ABI bump.

apt-get update
apt-get install linux-generic-hwe-24.04   # only if you intend to run 7.0 HWE
reboot
uname -r

Ubuntu 22.04: CVE-2025-39682 is not-affected; CVE-2025-39964 is in 5.15.0-164.174; CVE-2026-53266 was still pending on linux / linux-aws / linux-kvm as of this fetch. Do not close 22.04 against 53266 until the tracker says released for your flavor.

Red Hat's documented mitigation for 53266, if you cannot patch yet: drop ebtables SNAT rules that rewrite ARP sender hardware addresses on bridges. That is Red Hat's text, not a substitute for the kernel fix.

3. kTLS: check whether the 9.8 vector is even in play

# loaded?
lsmod | grep -E '^tls'
# in-use sockets (needs iproute2 with kTLS support)
ss -tnp | head
# many stacks never enable kernel TLS; absence of the module is evidence, not a patch

If tls is not loaded and nothing is attaching kTLS, CVE-2025-39682 is still a KEV row you should patch on a scheduled reboot - it is not the same urgency as an internet-facing unauth panel RCE. Label it that way in the ticket.

4. ebtables / AF_ALG: local, not "anyone on the internet"

CVE-2026-53266 and CVE-2025-39964 are local on NVD. They still belong on a hosting box's patch list because a single popped WordPress uid is a local user. They are not unauthenticated WAN RCEs. CISA listed them because of confirmed exploitation, not because the CVSS attack vector is network.

Red Hat additionally says 53266 needs specific bridge netfilter rules. If the host has no bridge + ebtables SNAT + ARP rewrite, impact is reduced. Reduced is not "not in KEV."

After you patched - BOD 26-04 triage, without a PoC

CISA's required action on these rows includes forensic triage on internet-exposed assets. For a kernel bug that is not a tidy HTTP signature, that means boring host forensics, not a Nuclei template:

  • Unexpected kernel taint, oops, or netfilter traces around the KEV date and the days before it.
  • New local users, new authorized_keys, new systemd units, unexplained cron.
  • New bridge / ebtables / nftables rules you did not write.
  • KernelCare or ksplice history that does not include these CVE IDs on hosts that should have them.

CISA did not publish IOCs for these three. Do not paste someone else's "kernel exploit detector" into production.

What we don't know

  • CISA confirmed exploitation. That is all. No actor, no malware family, no "ransomware: Known." knownRansomwareCampaignUse is Unknown on every row.
  • No public exploit recipe is cited here. Kernel commit messages describe the defect. They do not describe an in-the-wild chain. We will not reconstruct one.
  • Ubuntu 22.04 / 24.04 generic kernels were still pending for CVE-2026-53266 in the official CVE JSON at fetch time (2026-09-30). That can change. Re-query https://ubuntu.com/security/cves/CVE-2026-53266.json before you tell a customer they are done.
  • NVD vs Ubuntu vs Red Hat scores disagree on 53266 and 39964. Quote the source next to the number. Do not average them.
  • kTLS 9.8 is not "every Linux box is remotely owned." It is a critical score on a subsystem many hosting kernels never enable. Inventory first.
  • These are not the WordPress Core KEV (CVE-2026-87902, added 2026-09-25) and not the panel CVEs from last week. Different software, different patch command.

Sources

  • CISA alert, 2026-09-18 - "CISA Adds Two Known Exploited Vulnerabilities to Catalog" (CVE-2025-39964, CVE-2026-53266)
  • CISA alert, 2026-09-18 - "CISA Adds One Known Exploited Vulnerability to Catalog" (CVE-2025-39682)
  • CISA KEV JSON - https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (catalogVersion 2026.09.29, dateReleased 2026-09-29T13:51:33Z; all three dateAdded 2026-09-18, dueDate 2026-09-21, ransomware Unknown)
  • NVD - CVE-2025-39682 (9.8 CRITICAL, published 2025-09-05, modified 2026-09-21)
  • NVD - CVE-2026-53266 (8.8 HIGH, published 2026-06-25, modified 2026-09-19)
  • NVD - CVE-2025-39964 (7.8 HIGH, published 2025-10-13, modified 2026-09-19)
  • Ubuntu Security API - CVE-2025-39682, CVE-2026-53266, CVE-2025-39964 JSON (fetched 2026-09-30)
  • Ubuntu USN-8726-1 - 2026-09-07, 26.04 and 24.04 HWE 7.0 package list, includes CVE-2026-53266
  • Debian security tracker - CVE-2025-39682, CVE-2026-53266, CVE-2025-39964 (fetched 2026-09-30)
  • Red Hat CVE-2026-53266 - Important, RH CVSS 7.5, mitigation on ebtables SNAT ARP rewrite
  • kernel.org stable commits listed in the KEV notes field for each CVE

Ready to build your infrastructure?

Get a quote from our Hyderabad-based team - Tier IV datacenter, real support, INR or USD billing.

View pricingRequest a quoteWhatsApp sales