Linux Kernel kTLS and netfilter Flaws Added to the KEV Catalog
In September 2026 CISA added several Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2025-39682 in the kTLS receive path and CVE-2026-53266 in netfilter ebtables. The additions matter because kernel flaws sit below the application layer, where the usual controls for web services do not reach.
The three flaws
CVE-2025-39682 is rated 9.8 and concerns an improper condition check in the kTLS receive path, which leads to memory corruption. CVE-2025-39964 is a race condition on concurrent writes in AF_ALG, rated 7.8. CVE-2026-53266 is an out of bounds write in ebtables SNAT handling, rated 8.8. CISA required federal agencies to apply fixes by 21 September 2026 for the set, a short deadline that signals confirmed exploitation rather than theoretical risk.
Why kernel issues are awkward to remediate
Application security often assumes the underlying operating system is trustworthy. A kernel flaw breaks that assumption, because code running below the application can undermine isolation, containers and privilege boundaries that higher level controls depend on.
The remediations are also operational rather than code level in the usual sense. Fixing a kernel issue means updating the kernel package and rebooting, which is why kernel patches tend to sit in maintenance windows. In environments with long uptime requirements, that delay is exactly the window attackers use. Teams running container platforms should remember that the host kernel is shared, so a single unpatched node can affect every workload on it.
What to prioritize
The realistic prioritization is internet facing hosts and production servers first, followed by anything with privileged workloads. Reviewing the running kernel version against the fixed releases for the distribution is the concrete first step. Enabling kernel level monitoring for unexpected module loads and unusual privilege changes helps detect post exploitation activity, which is difficult to see from application logs alone.
Limits
Public write-ups do not include a demonstrated exploit chain for each of these CVEs, and the KEV listing confirms exploitation in the wild without quantifying it. The severity scores describe potential impact.
References
- Bilibili, Frontier AI and security briefing 2026-09-20, http://www.bilibili.com/read/cv53094956/
- CSDN, Daily security intelligence report 2026-09-22, https://m.blog.csdn.net/weixin_45635831/article/details/166323355
Top comments (0)