On September 18, 2026, CISA added three vulnerabilities in the Linux kernel to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The affected subsystems are kTLS, netfilter bridge ebtables, and the AF_ALG cryptographic interface. The remediation deadline for U.S. federal agencies is September 21, 2026. At the time of publication, the specific exploitation mechanisms, victims, and attack attribution remain unknown.
Technical details of the vulnerabilities
CVE-2025-39682 — logic error in kTLS
CVE-2025-39682 is an “Improper Check for Unusual or Exceptional Conditions” vulnerability in the kTLS (kernel TLS) receive path. A logic error when processing zero-length records from rx_list allows a sequence of mixed-type records to bypass content-type checking within a single recvmsg() call and proceed to data processing. According to the Red Hat advisory, the vulnerability can be triggered remotely if the TLS ULP (CONFIG_TLS) module is enabled on the system and is attached to TCP sockets via SOL_TLS. The impact is disclosure of memory contents or denial of service.
There is an important discrepancy in severity assessments: cve.org assigns this vulnerability a CVSS score of 9.8, while Red Hat’s product-specific rating is 7.0. The original source cites only the cve.org score without specifying the source, which may create an inflated impression of risk for particular configurations. In addition, the original source characterizes the vulnerability as local, whereas Red Hat points to the possibility of remote exploitation when kTLS is enabled — a significant divergence that affects prioritization.
CVE-2026-53266 — out-of-bounds write in ebtables SNAT
CVE-2026-53266 is an out-of-bounds write vulnerability (CWE-825) in the netfilter bridge ebtables SNAT module. According to Red Hat, when rewriting the sender ARP hardware address in ebtables SNAT rules, underlying memory pages are modified incorrectly. Exploitation requires that the system have specialized bridge netfilter rules operating on ARP traffic on bridge interfaces. The consequences are unpredictable system behavior, denial of service, or local privilege escalation. The cve.org score is CVSS 8.8, Red Hat’s score is 7.5.
CVE-2025-39964 — race condition in AF_ALG
CVE-2025-39964 is a race condition vulnerability (CWE-366) in the Linux kernel’s user-space cryptographic API. According to the Red Hat advisory, concurrent write operations to the same AF_ALG socket lead to interleaving of data and an inconsistent internal state of the socket. A local user can cause a system crash or corrupt the results of cryptographic operations, creating a risk of denial of service and data integrity violation. The cve.org score is CVSS 7.8, Red Hat’s score is 5.5.
Discrepancies in severity ratings
All three vulnerabilities show a significant discrepancy between cve.org scores and Red Hat’s product-specific ratings. The difference ranges from 1.3 to 2.8 points. This is due to the fact that Red Hat evaluates vulnerabilities in the context of specific product configurations, whereas cve.org uses a worst-case theoretical scenario. When prioritizing patches, organizations should take both sets of scores into account and correlate them with their actual configuration.
Impact assessment
Each of the three vulnerabilities has specific prerequisites for exploitation, which significantly narrows the set of affected systems. CVE-2025-39682 is relevant only for systems with the kTLS module enabled — typically servers that use kernel-level TLS hardware acceleration. CVE-2026-53266 requires bridge interfaces with ebtables SNAT rules for ARP — a configuration typical of virtualization hosts and network gateways. CVE-2025-39964 affects systems where user-space processes access the kernel cryptographic API via AF_ALG sockets.
There is no information on whether these vulnerabilities are used as part of a single attack chain. None of the available sources describes specific exploitation techniques, victims, or the threat actors behind the attacks. Previously, we analyzed the addition of Linux vulnerabilities to the KEV catalog, and the current case confirms the trend: the Linux kernel remains a priority target for attackers.
Protection recommendations
Red Hat provides specific mitigation measures for each vulnerability until full patches are released:
- CVE-2025-39682: block loading of the
tlsmodule via the kernel blacklist mechanism. Instructions are available in the Red Hat advisory. - CVE-2026-53266: disable rewriting of ARP hardware addresses in ebtables SNAT rules or remove ebtables SNAT rules that operate on ARP traffic on bridge interfaces.
- CVE-2025-39964: block loading of the
af_algmodule via the kernel blacklist.
It should be taken into account that blocking the tls and af_alg modules may disrupt applications that depend on kernel-level TLS hardware acceleration or the AF_ALG cryptographic API, respectively. Before applying these measures, it is necessary to check dependencies in the production environment. Full ranges of affected versions and patch identifiers are not specified in the available Red Hat advisories at the time of analysis.
Earlier we also analyzed the RefluXFS vulnerability in the Linux kernel, where a similar race condition led to privilege escalation — CVE-2025-39964 belongs to the same class of issues.
Organizations running Linux servers with kTLS enabled, ebtables bridge interfaces, or the AF_ALG cryptographic API should immediately review their configurations and apply the described mitigation measures. For systems where blocking modules is unacceptable, the priority should be to update the kernel to a fixed version as soon as the vendor releases the corresponding patches.
