{"id":1850,"date":"2026-09-21T20:15:49","date_gmt":"2026-09-21T14:45:49","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1850"},"modified":"2026-09-24T11:44:06","modified_gmt":"2026-09-24T06:14:06","slug":"cisa-kev-update-three-linux-kernel-vulnerabilities-exploited-in-the-wild","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/cisa-kev-update-three-linux-kernel-vulnerabilities-exploited-in-the-wild\/","title":{"rendered":"CISA KEV Update: Three Linux Kernel Vulnerabilities Exploited in the Wild"},"content":{"rendered":"

The CISA KEV Linux kernel update puts three vulnerabilities on the urgent remediation list. The flaws affect kernel TLS processing, ebtables network handling, and cryptographic sockets, creating risks that include memory disclosure, service disruption, and privilege escalation.<\/p>\n

The Hacker News reported that CISA added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its Known Exploited Vulnerabilities catalog on September 18, 2026. Its report identifies September 21 as the recommended remediation date for Federal Civilian Executive Branch agencies. Public reporting has not established a shared attack chain.<\/p>\n

For IT and security teams, the immediate task is to identify affected systems, validate vendor fixes, and investigate suspicious activity.<\/p>\n

What does the CISA KEV Linux kernel update cover?<\/h2>\n

These vulnerabilities affect separate kernel components. Exposure depends on the installed kernel, distribution patches, and relevant system configuration.<\/p>\n

CVE-2025-39682: Kernel TLS receive processing<\/h3>\n

This flaw involves mishandling zero-length records in the kernel TLS receive path. Red Hat<\/a> explains that mixed record types can bypass a receive-call constraint. Crucially, its advisory describes remote triggering when kernel TLS is enabled and attached to the relevant sockets. Teams should therefore avoid treating this solely as a local authenticated-user issue. Assess whether affected services actually use kernel TLS.<\/p>\n

CVE-2026-53266: ebtables ARP rewriting<\/h3>\n

The ebtables SNAT flaw affects ARP hardware-address rewriting. Red Hat<\/a> identifies potential privilege escalation, memory corruption, and denial of service, with exposure tied to specific bridge netfilter configurations. Review hosts using these networking rules before deciding remediation priority. The advisory also describes disabling the affected rewriting behavior as a mitigation, subject to operational validation.<\/p>\n

CVE-2025-39964<\/a>: Concurrent cryptographic socket writes<\/h3>\n

AF_ALG sockets allow unprivileged userspace applications to interact with the kernel crypto API where system policy permits. CVE-2025-39964 allows concurrent writes to the same socket, interleaving payloads and corrupting internal state. A local attacker could exploit this flaw to crash the system or corrupt cryptographic results. The fix prevents concurrent writes by enforcing exclusive write ownership.<\/p>\n

\n
\n
\n
\n \"cybersecurity-kit\"\n <\/div>\n <\/div>\n
\n
\n Featured Resource\n <\/h5>\n

\n Cybersecurity kit\n <\/h4>\n

\n Access essential cybersecurity resources to strengthen security, reduce risk, and improve cyber resilience.\n <\/p>\n \n Download the Resource Kit\n \n \n \n \n <\/g>\n <\/svg>\n\n <\/a>\n <\/div>\n <\/div>\n <\/section>\n

How should enterprise teams respond?<\/h2>\n

Start with an inventory of Linux workstations, servers, and infrastructure hosts. Assign an owner to each affected asset and record its distribution, kernel package, operational role, and remediation status.<\/p>\n

Validate exposure to CISA KEV Linux kernel flaws<\/h3>\n

Check each CVE against the distribution vendor\u2019s advisory. Use Hexnode\u2019s Live Terminal to run uname -r on individual Linux devices. For fleet-wide checks, use Execute Custom Script to deploy a script containing this command and collect running kernel versions. Compare the results and installed package versions against vendor advisories to validate exposure.<\/p>\n

Patch and investigate in parallel<\/h3>\n

Test applicable updates, deploy them through an expedited change process, and complete any vendor-required reboot. Verify the running kernel afterward and confirm that critical services remain healthy. Track unsuccessful installations and deferred restarts until someone resolves them.<\/p>\n

For investigation, review unexpected privileged processes, unfamiliar SSH access, new persistence mechanisms, and unexplained kernel crashes. These are general hunting leads, not published indicators specific to these exploits. Preserve relevant evidence before making disruptive changes.<\/p>\n

How can Hexnode support Linux remediation?<\/h2>\n

Hexnode UEM<\/a> provides automated Linux patch deployment for supported devices running Ubuntu 18.04 LTS and later, Linux Mint 21 and later, and Fedora 36 and later. Devices must be enrolled and have the Hexnode Linux Agent installed.<\/p>\n

Administrators can configure Auto Patch to select updates using criteria such as severity, classification, and update name. Group assignments and target filters help scope deployment. Approval requirements support testing before rollout, while maintenance-window controls coordinate installation and reboots.<\/p>\n

Technician notifications report installation status and failures, and configurable retries help address failed automation actions. For these CVEs, administrators should first map vendor fixes to available updates, then verify deployment results and the active kernel. These capabilities support patch execution; they do not establish that every listed CVE is automatically detected or remediated.<\/p>\n

FAQs<\/h2>
Why were these Linux kernel vulnerabilities added to the CISA KEV catalog?<\/span>\n
<\/span><\/span><\/div>\n <\/div>

CISA KEV additions indicate that there is evidence of active exploitation associated with the listed vulnerabilities. The three flaws affect different Linux kernel components, and public reporting does not establish that attackers are using them together as a single exploit chain.<\/p>\n<\/div><\/div><\/div>\n

Are all Linux systems affected by the three CISA KEV kernel vulnerabilities?<\/span>\n
<\/span><\/span><\/div>\n <\/div>

No. Exposure depends on factors such as the installed kernel package, distribution-specific patches and relevant subsystem configuration. Administrators should check each CVE against their Linux distribution vendor\u2019s advisory rather than relying only on upstream kernel version numbers.<\/p>\n<\/div><\/div><\/div>\n

Can CVE-2025-39682 be exploited remotely?<\/span>\n
<\/span><\/span><\/div>\n <\/div>

Red Hat describes remote triggering when kernel TLS is enabled and attached to the relevant sockets. Teams should therefore determine whether affected services actually use kernel TLS instead of treating the vulnerability solely as a local-user issue.<\/p>\n<\/div><\/div><\/div><\/div><\/div>\n

Turn exploitation evidence into verified remediation<\/h3>\n

Active exploitation demands prompt action. Identify affected assets, apply appropriate fixes, verify completion, and investigate suspicious behavior. Keep unresolved systems visible until remediation is confirmed.<\/p>\n

<\/div><\/div>
Strengthen Linux Vulnerability Response<\/h5>

Identify vulnerable endpoints, prioritize remediation, and strengthen Linux security with Hexnode UEM and XDR.<\/p>