AI News Feed
Market watch
Seoul Stocks Trim Early Gains; KOSPI Up 1.58% on AI OptimismZhiruitong Launches EMA-7132 Mini-ITX Board with Dual PCIe for Medical ImagingAiling Launches Always-On Recording Bean as Wearable AI Recorder Race Heats UpLG Electronics, Microsoft to Expand AI PartnershipwatchOS 27.2 Beta 2 Restores App Switcher With New Long-Press GestureGoogle opens Android Auto games to general availability and expands Motion Assist
Seoul Stocks Trim Early Gains; KOSPI Up 1.58% on AI OptimismZhiruitong Launches EMA-7132 Mini-ITX Board with Dual PCIe for Medical ImagingAiling Launches Always-On Recording Bean as Wearable AI Recorder Race Heats UpLG Electronics, Microsoft to Expand AI PartnershipwatchOS 27.2 Beta 2 Restores App Switcher With New Long-Press GestureGoogle opens Android Auto games to general availability and expands Motion Assist
Cybersecurity

CISA Gives Federal Agencies Three Days to Patch Three Exploited Linux Kernel Flaws

CISA added three Linux kernel flaws to its Known Exploited Vulnerabilities catalog on September 18, 2026, with a three-day patching deadline. Red Hat confirmed all three are being exploited in real-world attacks.

AI News Feed · 2026-09-22 11:39

The flaws are CVE-2025-39682, rated 9.8 out of 10 and classified critical; CVE-2026-53266, rated 8.8 and classified high; and CVE-2025-39964, rated 7.8 and classified high. All three have been fixed in the Linux kernel. CVE-2025-39682 was patched in stable releases 6.1.149, 6.6.103, 6.12.44 and 6.16.4. CVE-2025-39964 was fixed in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9. CVE-2026-53266 was fixed upstream and backported to supported stable and distribution kernel branches, including 5.10.259, 6.1.176 and 6.12.94.

CVE-2025-39682 is an improper check for unusual or exceptional conditions in the TLS receive path, which could let unauthenticated attackers carry out memory disclosure or denial-of-service attacks. CVE-2026-53266 is an out-of-bounds write in the ebtables SNAT ARP rewrite patch, allowing local attackers to escalate privileges or mount denial-of-service attacks. CVE-2025-39964 is a race condition that permits concurrent writes to the same AF_ALG socket, which local attackers could use to crash a system or corrupt cryptographic results, creating data integrity problems and possible denial-of-service conditions.

Red Hat said in all three advisories that the vulnerabilities are being abused. "This CVE is high risk and there are known public exploits leveraging this vulnerability. Address this vulnerability with high priority," the company wrote. No details have been published about who is using the exploits, whom they target or to what end, and no separate cyberattack reports referencing the three vulnerabilities have appeared.

CISA added all three on September 18, with a three-day patching deadline that expired on September 21. The agency normally gives Federal Civilian Executive Branch agencies about three weeks to remediate, reserving shorter windows for exceptionally dangerous flaws.

Fixes exist for all three, and two have workarounds. Users can prevent the tls module from being loaded to address CVE-2025-39682, and can disable ARP hardware address rewriting in ebtables SNAT rules or remove SNAT rules that operate on ARP traffic on bridge interfaces to address CVE-2026-53266. No working mitigation has been identified for CVE-2025-39964, leaving patching as the only option. According to the Red Hat advisory, CVE-2025-39682 may be remotely triggerable, but only when a system uses the affected kTLS receive path; the other two are local-only vulnerabilities.

Kernel vulnerabilities are generally treated as serious, though severity depends on the specific flaw and how the affected kernel is deployed. Earlier in 2026, researchers disclosed four local privilege escalation flaws named DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) and DiagSpill (CVE-2026-74469).

Editor's Summary

CISA added three Linux kernel flaws, CVE-2025-39682, CVE-2026-53266 and CVE-2025-39964, to its Known Exploited Vulnerabilities catalog on September 18, 2026, with a three-day deadline that expired September 21. Red Hat confirmed all three are being exploited and said public exploits exist. Patches are available for all three, while working mitigations exist for only two.