CISA KEV: three Linux kernel flaws (CVE-2025-39682 / CVE-2026-53266 / CVE-2025-39964); AF_ALG LPE/Docker escape detail (IDNsec)

Vulnerability

Published 2026-09-18

Verified 2026-09-28

CISA KEV: three Linux kernel flaws (CVE-2025-39682 / CVE-2026-53266 / CVE-2025-39964); AF_ALG LPE/Docker escape detail (IDNsec)

CISA added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities catalog on 18 September 2026, citing active exploitation. CVE-2025-39682 (NVD CVSS 3.1 9.8 Critical): improper check in the TLS receive path — zero-length records on rx_list can bypass intended recvmsg() record-type handling. CVE-2026-53266 (NVD 8.8 High): out-of-bounds write in ebtables SNAT ARP rewrite path. CVE-2025-39964 (NVD 7.8 High): AF_ALG race allowing concurrent writes to the same crypto socket, leaving inconsistent socket state (CWE-362).

UPDATE 25 September 2026 — IDNsec / Muhammad Alifa Ramdhan (STAR Labs; kernelCTF US$113,337): retrospective shows CVE-2025-39964 can escalate a local user to root and escape a Docker container via scatterlist/usercopy oracle → core_pattern overwrite; Cybersecurity News amplify same day. Upstream fix adds exclusive write ownership on af_alg_sendmsg; CSN cites fixed stables including Linux 5.10.246, 5.15.195, 6.1.155, 6.6.109, 6.12.50, 6.16.10 (confirm via distro advisories).

CISA BOD 26-04 FCEB due 21 September 2026; ransomware use Unknown; forensic triage required. Distinct from DirtyAH6/PPPoEject/TUNderflow/DiagSpill local-root quartet. Primary: CISA KEV; research: IDNsec; CVSS from NVD.

Product

Linux kernel (TLS rx_list / ebtables SNAT ARP / AF_ALG crypto sockets)

Versions

Long-standing kernel lines — apply distribution security updates covering the three CVEs. CSN (25 Sep) cites fixed stables incl. 5.10.246, 5.15.195, 6.1.155, 6.6.109, 6.12.50, 6.16.10; confirm via distro/vendor advisories. Discontinue EoL kernels.

CVSS

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (39682 NVD); CVE-2025-39964 NVD SECONDARY CVSS:3.1

AVAttack Vector: Network
ACAttack Complexity: Low
PRPrivileges Required: None
UIUser Interaction: None
SScope: Unchanged
CConfidentiality: High
IIntegrity: High
AAvailability: H (39682 NVD); CVE-2025-39964 NVD SECONDARY CVSS:3.1

(CVE-2025-39682 NVD CVSS 3.1 Critical); also 8.8 (CVE-2026-53266), 7.8 (CVE-2025-39964)

Exploited in Australia?

unknown

Patch to

Install vendor/distro kernel security updates covering CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964; reboot into the patched kernel. FCEB: meet CISA BOD 26-04 due date 2026-09-21 and forensic-triage guidance in KEV notes. Prioritise multi-tenant / container hosts where untrusted local code can run.

vulnerabilities network cloud