CISA Adds Two Linux Kernel Vulnerabilities to KEV Catalog Amid Active Exploitation
CISA has added two Linux Kernel vulnerabilities, CVE-2025-39964 and CVE-2026-53266, to its Known Exploited Vulnerabilities (KEV) Catalog due to evidence of active exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has announced the addition of two new vulnerabilities affecting the Linux Kernel to its Known Exploited Vulnerabilities (KEV) Catalog. This inclusion signifies that CISA has confirmed evidence of active exploitation of these flaws in the wild, posing a significant risk to organizations.
The first vulnerability, designated CVE-2025-39964, is a race condition within the Linux Kernel. Race conditions occur when the outcome of a computation depends on the sequence or timing of other uncontrollable events. In the context of a kernel, such conditions can lead to unpredictable behavior, data corruption, or even privilege escalation if exploited by malicious actors.
The second vulnerability, CVE-2026-53266, is an out-of-bounds write flaw in the Linux Kernel. This type of vulnerability arises when a program attempts to write data beyond the allocated buffer boundaries. Successful exploitation can overwrite adjacent memory, potentially corrupting critical data structures, crashing the system, or enabling attackers to inject and execute malicious code.
CISA emphasizes that vulnerabilities like these are frequently leveraged by malicious cyber actors as attack vectors. Their presence in the KEV Catalog serves as a critical alert for organizations, particularly Federal Civilian Executive Branch (FCEB) agencies, which are mandated by Binding Operational Directive (BOD) 26-04 to prioritize the remediation of such high-risk vulnerabilities on publicly exposed assets.
Binding Operational Directive 26-04 mandates that FCEB agencies must prioritize the patching of vulnerabilities listed in the KEV Catalog, especially those that grant total control of an asset post-exploitation. This directive aims to ensure that critical infrastructure and government systems are protected against known, actively exploited threats in a timely manner.
While BOD 26-04 specifically applies to federal agencies, CISA strongly encourages all organizations, regardless of sector, to adopt a risk-based vulnerability management approach. This includes actively monitoring the KEV Catalog and prioritizing the remediation of listed vulnerabilities to bolster their overall cybersecurity posture.
CISA continues to monitor the threat landscape and will add new vulnerabilities to the KEV Catalog as evidence of active exploitation emerges. The agency also provides a KEV Nomination Form for the public to submit potential candidates, requiring a CVE ID, proof of exploitation, and clear mitigation guidance for consideration.
The inclusion of these two Linux Kernel vulnerabilities underscores the persistent threat posed by kernel-level exploits and the importance of robust vulnerability management practices for maintaining system integrity and security across all organizations.
CISA has added CVE-2025-39682, a Linux Kernel vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability, identified as an "Improper Check for Unusual or Exceptional Conditions," is now confirmed to be actively exploited in the wild, posing a significant risk to federal agencies and encouraging broader adoption of risk-based vulnerability management.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has now added a third Linux kernel vulnerability, CVE-2025-39682, to its Known Exploited Vulnerabilities (KEV) catalog. This critical flaw, affecting the TLS receive path with a CVSS score of 9.8, was not included in the previous advisory that flagged CVE-2025-39964 and CVE-2026-53266. Red Hat has also updated its advisories to acknowledge active exploitation of CVE-2025-39682, urging high-priority patching.
CISA has now added a third Linux kernel vulnerability, CVE-2025-39682, to its Known Exploited Vulnerabilities (KEV) catalog, alongside the previously mentioned CVE-2025-39964 and CVE-2026-53266. This critical flaw, rated CVSS 9.8, resides in the TLS receive path and has been actively exploited in the wild, necessitating urgent remediation by federal agencies by September 21 under Binding Operational Directive 26-04.
The new article provides further technical details on the CVE-2025-39964 vulnerability, explaining the race condition in the AF_ALG sendmsg() handling path and how it can be exploited to achieve arbitrary kernel write by overwriting core_pattern. It also highlights the discovery by Muhammad Alifa Ramdhan of STAR Labs and the $113,337 reward received for the kernelCTF submission.