CISA Adds Two Linux Kernel Vulnerabilities to KEV Catalog Amid Active Exploitation
CISA has added two Linux Kernel vulnerabilities, CVE-2025-39964 and CVE-2026-53266, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced the addition of two new vulnerabilities affecting the Linux Kernel to its Known Exploited Vulnerabilities (KEV) Catalog. This inclusion signifies that CISA has confirmed evidence of active exploitation of these flaws in the wild, posing a significant risk to organizations.
The first vulnerability, designated CVE-2025-39964, is a race condition within the Linux Kernel. Race conditions occur when the outcome of a computation depends on the sequence or timing of other uncontrollable events. In the context of a kernel, such conditions can lead to unpredictable behavior, data corruption, or even privilege escalation if exploited by malicious actors.
The second vulnerability, CVE-2026-53266, is an out-of-bounds write flaw in the Linux Kernel. This type of vulnerability arises when a program attempts to write data beyond the allocated buffer boundaries. Successful exploitation can overwrite adjacent memory, potentially corrupting critical data structures, crashing the system, or enabling attackers to inject and execute malicious code.
CISA emphasizes that vulnerabilities like these are frequently leveraged by malicious cyber actors as attack vectors. Their presence in the KEV Catalog serves as a critical alert for organizations, particularly Federal Civilian Executive Branch (FCEB) agencies, which are mandated by Binding Operational Directive (BOD) 26-04 to prioritize the remediation of such high-risk vulnerabilities on publicly exposed assets.
Binding Operational Directive 26-04 mandates that FCEB agencies must prioritize the patching of vulnerabilities listed in the KEV Catalog, especially those that grant total control of an asset post-exploitation. This directive aims to ensure that critical infrastructure and government systems are protected against known, actively exploited threats in a timely manner.
While BOD 26-04 specifically applies to federal agencies, CISA strongly encourages all organizations, regardless of sector, to adopt a risk-based vulnerability management approach. This includes actively monitoring the KEV Catalog and prioritizing the remediation of listed vulnerabilities to bolster their overall cybersecurity posture.
CISA continues to monitor the threat landscape and will add new vulnerabilities to the KEV Catalog as evidence of active exploitation emerges. The agency also provides a KEV Nomination Form for the public to submit potential candidates, requiring a CVE ID, proof of exploitation, and clear mitigation guidance for consideration.
The inclusion of these two Linux Kernel vulnerabilities underscores the persistent threat posed by kernel-level exploits and the importance of robust vulnerability management practices for maintaining system integrity and security across all organizations.