CISA put three Linux kernel bugs on KEV. The 9.8 is kTLS, not a generic kernel CVE.

CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 landed in KEV on 18 September. Federal due date is Monday. Red Hat still scores the TLS bug 7.0 and local. Patching uname without asking whether tls.ko is loaded is not triage.

RWP Ventures · 2026-09-19 · event 2026-09-18 · 12 min read · priority 8.6

They are not one bug.

Do not inventory “Linux” and close the ticket. 39682 is a kTLS bug. Red Hat’s statement: it can be remotely triggered only when kernel TLS is in use (CONFIG_TLS, TLS ULP on a TCP socket). 53266 needs ebtables SNAT that rewrites ARP sender hardware addresses on a bridge. 39964 is the AF_ALG crypto socket. A host on an affected kernel with none of those features is not the same exposure as a kTLS offload endpoint on the internet.

CISA published two alerts the same day — one CVE, then two — not a single bundled advisory. The Hacker News carried the combined English write-up on 19 September and said Red Hat updated all three advisories at 02:00 UTC 19 September to acknowledge active exploitation. RWP did not independently extract a “public exploits” sentence from the Red Hat HTML pages as rendered this morning; treat that clause as REPORTED via THN. CISA’s KEV listing is the confirmed exploitation signal.

This is not the 18 September LPE quartet (DirtyAH6 / TUNderflow / PPPoEject / DiagSpill). Different CVEs. Do not merge them.

What happened

CISA’s first 18 September KEV alert named CVE-2025-39682. The second named CVE-2025-39964 and CVE-2026-53266. The JSON feed matches both alerts. Due date 2026-09-21 on every row. Notes for 39682 and 53266 include the EoL/EoS sentence CISA uses when a component may ship inside other products.

CVE-2025-39682 is not new. kernel.org assigned it as a kTLS receive-path fix for zero-length records taken from rx_list. NVD published it in 2025. Red Hat’s securitydata JSON still lists public_date 2025-09-05 and RHEL 10 advisory RHSA-2025:16904. The news on 18–19 September is KEV, not discovery. Upstream unaffected floors in the CVE product-status block: before 6.0; 6.1.149+, 6.6.103+, 6.12.44+, 6.16.4+. Ubuntu’s tracker already shows distribution packages, not those numbers: 24.04 standard kernel listed Fixed 6.8.0-86.87; 25.04 Fixed 6.14.0-34.34. Do not match uname -r to 6.1.149 on an enterprise kernel.

CVE-2026-53266 is an ebtables SNAT bug: an ARP sender-hardware-address rewrite can write into a nonlinear socket-buffer fragment backed by a splice-imported file page. CVE.org 8.8, local, scope changed. Red Hat: Important, needs specific bridge netfilter rules. Workaround: disable ARP hardware-address rewriting in ebtables SNAT, or remove those ARP SNAT rules on bridge interfaces. Upstream unaffected floors include 5.10.259+, 5.15.210+, 6.1.176+, 6.6.143+, 6.12.94+. RHEL 9 advisory in Red Hat’s JSON: RHSA-2026:36645 (kernel-0:5.14.0-687.23.1.el9_8).

CVE-2025-39964 is an AF_ALG race: concurrent writes to the same socket interleave payloads and leave per-socket state inconsistent. Red Hat mitigation: prevent module af_alg from loading. CVE.org lists 7.8; Red Hat 5.5 and still draft on the CVSS object this morning.

The Hacker News, 19 September: no public details on how the three are being exploited, and no evidence they are one chain. That absence is the current record. Do not invent a named actor, a ransomware family, or a single exploit kit.

Separate story, same 18 September news cycle: researcher Asim Manizada published working local-root exploits for CVE-2026-80844, CVE-2026-81000, CVE-2026-68121, and CVE-2026-74469. THN: no reports of those four in real-world attacks. They are not in catalog 2026.09.18. Do not patch-ticket them as these KEV rows.

Why it matters

Three facts should not be collapsed.

First: KEV on the kernel is a fleet problem, not a single appliance SK. Every Linux image, AMI, container host, appliance, and engineering workstation is in the inventory question. BOD 26-04 still wants internet exposure evaluated. For 39682 that question is “is kTLS actually in use on a reachable socket,” not “does the box run Linux.”

Second: the CVSS split is operational. kernel.org rates 39682 9.8 network, no privileges. Red Hat rates it 7.0 with high attack complexity and an explicit kTLS prerequisite. NVD has a 7.1 local vector. Scanning teams that only sort by the 9.8 will over-rank boxes that never attach SOL_TLS. Teams that only read Red Hat “Moderate” will under-rank internet-facing kTLS offload. Both numbers are in the record. Use the feature, not the headline.

Third: 39682 is a year old. A 2025 stable fix sitting unapplied on a 2026 kTLS endpoint is the incident class. KEV does not mean the bug was born on Friday. It means CISA now has exploitation evidence that meets the catalog bar, and FCEB has until Monday.

We have no confirmed OT, ICS, or physical-process impact. A Linux historian, jump host, or vendor appliance next to a plant is still an IT kernel compromise unless someone produces process evidence. Do not write one.

Who / what is affected

Technical context

RWP is not reproducing TLS record sequences, ebtables rule syntax that triggers the write, or AF_ALG sendmsg races.

What defenders need from the primary records:

• 39682 — kTLS software receive path. A zero-length record already on rx_list can bypass the per-recvmsg() record-type rule and let later records be handled under the wrong zero-copy / queue assumptions. Red Hat workaround: do not load tls. That is a mitigation, not a substitute for the patched kernel if you need kTLS.
• 53266 — bridge ebtables SNAT. Ethernet-header rewrite and ARP SHA rewrite are different writable ranges. The bug is the ARP path writing through a non-writable splice-backed fragment. Workaround is configuration, then kernel.
• 39964 — AF_ALG allowed two writers on one socket. Fix is exclusive write ownership. Workaround: do not load af_alg.

ATT&CK mapping for what is stated, not a hypothetical chain:

• 39682, if a kTLS service is reachable: exploit public-facing application (T1190) against the kernel TLS ULP, not against OpenSSL-in-userspace as such.
• 53266 / 39964: exploitation for privilege escalation or crash (T1068 / T1499 class), local, with feature prerequisites.

Follow-on that is not claimed: a named C2, ransomware-Known, identity of these three with the Manizada quartet, or container-escape evidence.

Threat / exploitation status

High confidence on: CVE identifiers, KEV dates, due date, catalog version and count, CVSS split, kTLS / ebtables / AF_ALG prerequisites, distinctness from the LPE quartet, Ubuntu 39682 package floors cited above, RHSA identifiers in Red Hat’s JSON. Moderate confidence that internet-facing kTLS is the highest-leverage 39682 exposure (vendor statements; no census). Low confidence on in-wild technique, victim set, and whether the three KEV rows are one operation.

What defenders should do

1. Inventory the feature, not the distro string. For every Linux image: kernel package and booted kernel; whether tls is loaded and whether any process has a TLS ULP socket; whether bridge ebtables SNAT rewrites ARP; whether af_alg is loaded. Cloud AMIs, EKS/GKE nodes, appliances, WSL kernels, and vendor OT-adjacent Linux count. Record internet exposure for BOD 26-04.

1. Patch from the operating-system vendor and reboot onto that kernel. Upstream 6.1.149 is not an RHEL 9 uname. Confirm the RHSA / USN / DSA that names these CVEs, then confirm the running kernel. Ubuntu 39682: 24.04 6.8.0-86.87 is the floor Ubuntu lists for the standard kernel — check the flavor you actually run (AWS, azure, hwe).

1. If you cannot patch before Monday, apply the documented workarounds on boxes that use the feature. Blacklist tls only if you do not need kTLS. Remove ARP SHA rewrite from ebtables SNAT. Blacklist af_alg if you do not need the userspace crypto socket. Workarounds are not forensic closure.

1. Hunt before you declare the host clean. CISA’s required action includes forensics-triage language. Preserve kernel logs, crash dumps, and process lists on internet-facing kTLS endpoints before the reboot that is supposed to close the finding. There is no public IOC pack in the CISA alerts. Do not pretend there is. Look for unexplained tls / bridge netfilter / AF_ALG instability, not for a malware family name.

1. Do not spend the Monday clock on the wrong four CVEs. 80844 / 81000 / 68121 / 74469 are a local-root research drop with public exploits and no KEV row. Patch them on the distro schedule. They are not these three due dates.

1. Sequence the rest of today’s federal list. [Cisco ISE CVE-2026-76460](/posts/2026-09-17-cisco-ise-cve-2026-76460-auth-bypass/), Pixel CVE-2026-58704, and Acronis CVE-2026-87886 were KEV-due 19 September. [Check Point CVE-2026-91843](/posts/2026-09-18-checkpoint-mgmt-cve-2026-91843-root-rce/) is still not in 2026.09.18. [vCenter CVE-2026-59310](/posts/2026-09-16-vmware-vcenter-cve-2026-59310-ransomware/) remains ransomware-Known.

This is not an exploitation guide. Use the distro advisory and the module list.

RWP assessment

Score 8.6. CISA put three kernel CVEs on a Monday clock. One of them is a remotely triggerable kTLS receive-path bug that has been public since 2025. The other two are real and local, with feature gates Red Hat bothers to write down. English coverage and the Red Hat-update claim landed 19 September, after [yesterday’s Check Point management Daily Top](/posts/2026-09-18-checkpoint-mgmt-cve-2026-91843-root-rce/). RWP has not published these three as a Daily Top.

It outranks Orkes Conductor CVE-2026-58138 (THN 19 September; Fortinet outbreak; unauthenticated GraalVM RCE; patched in 3.30.2 since June; not KEV; narrower install base). It outranks Microsoft CVE-2026-85889 Azure AI Foundry CVSS 10 (17 September MSRC; already mitigated in the service; no customer action; no exploitation). It outranks Huntress’s Settra/MeshAgent write-up (two confirmed ransomware incidents, including manufacturing; tradecraft, not a new control-plane CVE). It outranks the Manizada LPE quartet as a story: public root exploits, no KEV, no in-wild. ISE 76460, SEG 76461, vCenter 59310, and Check Point 91843 are continuations of this week’s already-published tops.

The failure mode to sand down is “we don’t have a Linux CVE program because we are a Windows shop” and its twin, “every box with uname containing 6. is a 9.8.” Ask whether kTLS is on. Then patch the kernel you actually boot.

What we are watching

• Whether CISA or a vendor names a campaign, a ransomware brand, or a how for any of the three.
• Whether 39682 stays “Unknown” for ransomware, or the KEV row is revised.
• Distro lag on appliances and OEM kernels that will not show the Ubuntu/RHEL floors.
• Any attempt to treat the Manizada quartet as these KEV rows.
• ISE 76460 / Pixel 58704 / Acronis 87886 through the 19 September due date.
• Any attempt to treat a Linux kernel compromise at an industrial tenant as an OT event without process evidence.

Sources

• CISA — Adds two KEV (CVE-2025-39964, CVE-2026-53266) (18 September 2026)
• CISA — Adds one KEV (CVE-2025-39682) (18 September 2026)
• CISA KEV JSON feed
• CISA Known Exploited Vulnerabilities Catalog
• CVE.org — CVE-2025-39682
• CVE.org — CVE-2026-53266
• Red Hat — CVE-2025-39682
• Red Hat — CVE-2026-53266
• Red Hat — CVE-2025-39964
• The Hacker News — CISA Flags Three Linux Kernel Vulnerabilities (19 September 2026)
• The Hacker News — Public Exploits Released for Four Linux Kernel Flaws (18 September 2026)
• Ubuntu — CVE-2025-39682
• NVD — CVE-2025-39682
• CISA — BOD 26-04
• [RWP Daily Top, 18 September 2026 — Check Point CVE-2026-91843](/posts/2026-09-18-checkpoint-mgmt-cve-2026-91843-root-rce/)
• [RWP Daily Top, 17 September 2026 — Cisco ISE CVE-2026-76460](/posts/2026-09-17-cisco-ise-cve-2026-76460-auth-bypass/)
• [RWP Daily Top, 16 September 2026 — vCenter CVE-2026-59310](/posts/2026-09-16-vmware-vcenter-cve-2026-59310-ransomware/)