CISA adds Linux kernel flaws to exploited vulnerabilities catalog

As reported by Security Affairs, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three critical Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. This action mandates federal agencies to address these flaws by a specific deadline to mitigate potential security risks.

The vulnerabilities added are CVE-2025-39682, a flaw in the TLS receive path with a CVSS score of 9.8, which could allow local users to expose sensitive memory or cause a denial-of-service; CVE-2026-53266, an out-of-bounds write vulnerability with a CVSS score of 8.8, potentially leading to system crashes or privilege escalation; and CVE-2025-39964, a race condition vulnerability with a CVSS score of 7.8, which could impact system integrity and cryptographic operations.

Currently, there is no information available regarding exploitation in the wild or if these vulnerabilities are used in conjunction. CISA has ordered federal agencies to remediate these issues by September 21, 2026, as per Binding Operational Directive 22-01. Private organizations are also strongly advised to review the KEV catalog and patch their systems.

Source: Security Affairs