The Cybersecurity and Infrastructure Security Agency has issued an unusually urgent warning to government institutions, requesting rapid application of patches for three major defects discovered in the Linux kernel. These problems have recently been incorporated into the catalog of Known Exploited Vulnerabilities, a step signaling that attackers are already actively using them in real-world environments. The deadline imposed on federal authorities is extremely short, expiring on September 21, 2026, a period of only three days that deviates significantly from the standard three-week practice usually reserved for updates. The three defects, identified by the codes CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, present varying severity grades but all require immediate attention. The first, CVE-2025-39682, received a critical rating of 9.8 out of 10, indicating maximum risk. The following two are classified as high severity, with scores of 8.8 out of 10 for CVE-2026-53266 and 7.8 out of 10 for CVE-2025-39964.
All three errors have already been patched in the Linux kernel sources, and users must verify whether they are running the established versions or distribution releases containing the respective fixes. In the case of the first vulnerability, CVE-2025-39682, the issue consists of an inadequate check of exceptional conditions in the TLS reception module. This flaw allows an unauthenticated attacker to trigger either a memory disclosure or a denial-of-service attack. The fix has been implemented in the stable versions 6.1.149, 6.6.103, 6.12.44, and 6.16.4. According to Red Hat’s analysis, there is a possibility that this deficiency could be triggered remotely, but this occurs exclusively when the system uses the affected kTLS reception path. A hypothetical scenario describes how a malicious actor could send a specially crafted TLS record to cause a system crash or even arbitrary code execution.
The second problem, known as CVE-2026-53266, is an out-of-bounds write located in the ARP reconfiguration module for SNAT in ebtables. This error offers local attackers the capability to escalate privileges or induce a denial-of-service state. The fix has been integrated into the mainline and backported into the support branches of distributions, including versions 5.10.259, 6.1.176, and 6.12.94. Although it is a local vulnerability, it becomes dangerous in configurations involving network bridges or netfilter, where an attacker with basic access can exploit this weakness to gain full control of the node. The third deficiency, CVE-2025-39964, is a race condition error that allows concurrent writes to the same AF_ALG socket. The consequences can be severe for data integrity, as a local malicious actor could lead to system blocking or corruption of cryptographic operation results, thereby generating denial-of-service states.
The patch for this problem is available in versions 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, and 6.16.9. Red Hat has publicly confirmed that all three vulnerabilities are subject to active attacks, underscoring the existence of known public exploits. In its statements, the company emphasized the high risk and urged treatment with maximum priority. Although details regarding the identity of attackers or specific targets have not been made public, and independent reports on concrete incidents have not yet emerged, CISA’s rapid response suggests considerable severity. To mitigate risks until full patch installation, certain temporary measures are recommended for two of the three problems. For the first deficiency, users should prevent loading of the TLS module, thereby reducing the attack surface. CISA added these entries to the KEV catalog on September 18, 2026, obliging federal civilian executive branch agencies to remediate the defects before the September 21 deadline.
This unusual urgency underscores the importance of constant monitoring of the Linux kernel in critical infrastructures.