Linux users beware — CISA flags three major security issues you need to patch right now

CISA added three Linux kernel flaws (CVE‑2025‑39682, CVE‑2026‑53266, CVE‑2025‑39964) to KEV catalog Red Hat confirmed active exploitation; agencies given rare three‑day patch deadline expiring Sept 21, 2026 Bugs enable DoS, privilege escalation, or data corruption; patches available, limited mitigations for two flaws The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux flaws to its Known Exploited Vulnerabilities (KEV) catalog, signaling abuse in the wild and giving government agencies a deadline to patch or stop using the flawed product entirely.

The three bugs in question are tracked as CVE-2025-39682 (severity score 9.8/10 - critical), CVE-2026-53266 (severity score 8.8/10 - high), and CVE-2025-39964 (severity score 7.8/10 - high).

All three have already been patched in the Linux kernel.

CVE-2025-39682 was fixed in stable releases 6.1.149, 6.6.103, 6.12.44 and 6.16.4, while CVE-2025-39964 was fixed in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9.

CVE-2026-53266 has been fixed upstream and backported to supported stable/distribution kernel branches, including 5.10.259, 6.1.176 and 6.12.94.

The first issue is an improper check for unusual or exceptional conditions vulnerability in the TLS receive patch which could allow unauthenticated threat actors to launch memory disclosure or denial-of-service (DoS) attacks.

The second one (CVE-2026-53266) is an out-of-bounds write vulnerability in the ebtables Source Network Address Translation (SNAT) Address Resolution Protocol (ARP) rewrite patch which allows local attackers to escalate privileges or mount DoS attacks.

The last one (CVE-2025-39964) is a race condition flaw that allows concurrent writes to the same AF_ALG socket, which allows local malicious actors to crash the system or corrupt cryptographic operation results, leading to data integrity issues and possible DoS states.

Attacks in the wild Red Hat acknowledged that all three are being abused in real-life attacks.

“This CVE is high risk and there are known public exploits leveraging this vulnerability.

Address this vulnerability with high priority,” it said in all three advisories.

However, there are no details as to who is currently using these exploits, against whom, and to what cause.

There are currently no separate reports of cyberattacks referencing any of the abovementioned vulnerabilities.

However, CISA still reacted.