CISA tells federal agencies: patch three Linux kernel bugs within days, attackers already using them
Three Linux kernel flaws are being exploited in the wild. Federal agencies have until 21 September to patch, and the most serious carries a 9.8 severity score.
Key points
- The US Cybersecurity and Infrastructure Security Agency added three Linux kernel flaws to its Known Exploited Vulnerabilities catalogue on 18 September 2026, giving federal agencies until 21 September to patch.
- The headline bug, CVE-2025-39682, sits in the kernel's encrypted networking code and carries a severity score of 9.8 out of 10.
- CISA also added CVE-2025-39964, a race condition, and CVE-2026-53266, an out-of-bounds write, both in the Linux kernel and both flagged as actively exploited.
- CISA's advisory warns some affected builds are end-of-life, meaning there is no fix coming and operators should move off them.
- The three bugs were added under Binding Operational Directive 26-04, the new rule that forces agencies to prioritise flaws attackers are already using.
CISA has added three Linux kernel vulnerabilities to its must-patch list, and it says criminals are already using all of them. The Linux kernel is the core software that runs most cloud servers, most Android phones, and a large slice of the internet's back end, so a bug there tends to matter everywhere at once.
The agency published the additions on 18 September 2026 and set a federal patch deadline of 21 September. That is three days. In practice, that is CISA's way of saying the exploitation it is seeing is not theoretical.
What are the three bugs?
All three sit inside the Linux kernel itself, not an add-on app. The worst of them is CVE-2025-39682, rated 9.8, in the kernel's TLS receive path, which is the code that unwraps encrypted network traffic. A flaw there lets a specially shaped, empty encrypted record confuse the kernel into mishandling the records that follow. In plain terms, a remote attacker can trick a Linux server into reading its own memory in the wrong way while it processes encrypted traffic.
The other two, added a day earlier, are CVE-2025-39964, a race condition, where two bits of code fight over the same resource and one wins in a way the developer did not expect, and CVE-2026-53266, an out-of-bounds write, where the kernel writes data past the end of the memory it was supposed to use. Both are the kind of primitives that get chained into container escapes and privilege escalation.
| CVE | Bug type | Severity | KEV added |
|---|---|---|---|
| CVE-2025-39682 | TLS receive path flaw | 9.8 (critical) | 18 Sep 2026 |
| CVE-2025-39964 | Race condition | Not listed | 18 Sep 2026 |
| CVE-2026-53266 | Out-of-bounds write | Not listed | 18 Sep 2026 |
Should ordinary people worry?
Not directly, and not today. These are server-side and platform bugs. The failure mode here is a cloud host, a Kubernetes node or a network appliance getting broken into, not your laptop. What it means for regular users is downstream: services you rely on, from banking to healthcare portals, run on Linux fleets that now have a very short fuse to patch.
Android phones use the Linux kernel too, but Google ships its own patch cycle and there is nothing in CISA's notice pointing at handset exploitation.
What operators actually have to do
The binding directive CISA cites, BOD 26-04, does two things that matter beyond the federal government. It forces agencies to patch KEV-listed bugs on publicly exposed assets fast, and it tells them to check whether they were already broken into before the patch went on. That second bit is the part most private shops skip, and it is the part that ends up in the post-mortem.
CISA's own advisory flags that some affected Linux builds are end-of-life or end-of-service, and tells operators to move off them rather than wait for a fix that will not come. That is the quiet story here. Plenty of production fleets are still running kernels nobody upstream is patching, and a KEV listing does not conjure a backport out of thin air.
The Hacker News, which first flagged the three additions together, noted the TLS bug is the standout of the batch on severity alone. My read: 9.8 on a kernel network path with confirmed exploitation is the sort of thing red teams have been sitting on quietly, and the KEV entry is the moment the rest of the industry catches up.
Operational takeaway: pull your kernel inventory tonight, flag anything on an EoL branch, and treat the 21 September date as yours too.
