Back to Feed
VulnerabilitiesSep 19, 2026

CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

CISA adds three actively exploited Linux kernel vulnerabilities to its KEV catalog.

CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. These flaws, including CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, can lead to memory disclosure, denial-of-service, and privilege escalation. Federal agencies are advised to patch these vulnerabilities by September 21, 2026, as per Binding Operational Directive (BOD) 26-04.

AI summary of the linked source. Not reviewed by an editor. How this works

Vendor Watch

Run CISA?

Get an email when a new story names CISA, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy

The lesson from this incident

Full lesson

CISA has flagged three actively exploited Linux kernel vulnerabilities capable of causing memory disclosure, denial-of-service, and privilege escalation — a dangerous combination that could allow attackers to fully compromise affected systems. The fact that these flaws are already being exploited in the wild means organizations cannot afford a slow patch cycle; threat actors are actively leveraging these weaknesses before defenders can respond. Federal agencies face a hard deadline under BOD 26-04, but all organizations running Linux-based infrastructure should treat this with equivalent urgency regardless of regulatory obligation. Privilege escalation vulnerabilities are particularly severe, as they can allow an attacker who gains initial access to quickly elevate to root or kernel-level control, bypassing most defensive controls. This incident underscores the critical need for continuous vulnerability tracking and rapid remediation processes tied to threat intelligence feeds like the CISA KEV catalog.

What helps against this

How we list vendors

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

  • cve — CVE-2025-39682
  • cve — CVE-2026-53266
  • cve — CVE-2025-39964

Entities

Linux kernel (product)CISA (vendor)Red Hat (vendor)