CISA Orders Federal Agencies to Patch Two Linux Kernel Flaws

Key points

• CISA added CVE-2025-39964 and CVE-2026-53266, both Linux kernel bugs, to its Known Exploited Vulnerabilities Catalog, triggering mandatory action for federal civilian agencies under Binding Operational Directive 26-04.
• BOD 26-04 requires those agencies to prioritise rapid remediation on publicly exposed assets where exploitation would grant full control, and to check whether attackers were already inside before the patch went on.
• CVE-2026-53266 is an out-of-bounds write in the kernel's bridge netfilter code; CVE-2025-39964 is a race condition in the kernel crypto socket layer.
• CISA has not named the attackers or the targets, and the agency's advisory does not set a specific due date in the public listing.
• CISA is urging private sector organisations to treat the catalog as a prioritisation input even though the directive does not bind them.

The US Cybersecurity and Infrastructure Security Agency has placed two Linux kernel vulnerabilities on its Known Exploited Vulnerabilities Catalog, the running list of bugs the agency says are being used in real attacks. Federal civilian agencies must now act on them under Binding Operational Directive 26-04, the risk-based patching rule CISA finalised earlier this year.

The two bugs sit deep inside Linux, the open-source operating system that runs most cloud servers, a large share of corporate infrastructure, and Android phones.

What are the two bugs?

Both are flaws in the Linux kernel, the core piece of software that controls how a computer's hardware talks to everything else. One is a race condition in the crypto socket code; the other is an out-of-bounds write in the bridge firewall code. Either can be abused by a local attacker to gain deeper access on a machine they've already partially compromised.

CVE-2026-53266 sits in the ebtables SNAT code that rewrites Ethernet addresses on bridged traffic. The fix makes the ARP sender hardware address range writable before the kernel copies a new MAC address into it, closing a path where a crafted packet held in a nonlinear buffer could be written past its intended bounds.

CVE-2025-39964 is a concurrency bug in af_alg_sendmsg, the kernel routine that handles writes to sockets used for cryptographic operations. Two simultaneous writes to the same socket could interleave data and corrupt internal state. The patch adds a ctx->write field to enforce exclusive ownership.

Neither CVE record names an exploit chain or a victim. CISA's listing is the trigger; the technical detail sits in the upstream kernel commits.

What does BOD 26-04 actually require?

BOD 26-04 replaced the older KEV directive's flat patching model with a tiered approach. Federal Civilian Executive Branch agencies must prioritise rapid remediation of KEV entries on publicly exposed assets where successful exploitation would give an attacker total control. Lower-risk exposures can be deferred, on the theory that scarce patching capacity should follow actual risk.

The directive also imposes a compromise-assessment step: agencies must check whether a system was already breached before the patch went on, not just close the hole and move on. That's the newer, and arguably more consequential, half of the rule. We've followed BOD 26-04 since its introduction, and as our 27 August story on six actively exploited bugs showed, CISA hasn't been shy about stacking KEV additions quickly once a directive is live.

BOD 26-04 binds only civilian federal agencies. CISA encouraged private sector organisations to treat the KEV catalog as an input to their own vulnerability management, without any enforcement hook.

What should a normal Linux user do?

For most people, nothing beyond installing the routine updates their distribution ships. Major vendors push kernel updates through standard channels, and both bugs are already patched upstream. The urgency is for administrators running fleets of Linux servers, especially anything internet-facing, and for federal agency teams now on the clock.

CISA hasn't disclosed how the flaws are being exploited, or by whom. That gap matters. Without a named campaign, defenders outside government are being asked to prioritise on the strength of the catalog listing alone, and that's a harder sell when patching windows are tight and the risk picture is thin.