U.S. Authorities Add Three Vulnerabilities in Linux Kernel to Exploitation List

U.S. authorities have issued a warning regarding three vulnerabilities present in the Linux kernel that are reportedly being exploited. They are urging U.S. government agencies to take immediate action.

On September 18, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the three vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog. The agency is calling for not only the application of patches but also investigations into signs of compromise.

The vulnerability identified as CVE-2025-39682 is located in the Linux kernel's TLS processing function, kTLS. There is a risk that zero-length TLS records retrieved from the receive queue may not be processed correctly, leading to subsequent records being handled based on incorrect assumptions.

A vulnerability in ebtables, which processes packets in network bridges, has been identified as CVE-2026-53266. There is a risk of data being written to out-of-bounds memory when rewriting the source MAC address of ARP packets.

Additionally, CVE-2025-39964 is a race condition vulnerability in the AF_ALG interface, which allows cryptographic processing from user space. Simultaneous writes to the same socket may lead to unexpected data mixing, resulting in inconsistencies in the internal state of the socket.