CISA Confirms Active Exploitation of Two Linux Kernel Vulnerabilities: Immediate Patching Urged

Security Advisory | September 18, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. The announcement reinforces the importance of prioritising vulnerabilities based on real-world threat activity rather than relying exclusively on severity scores.

The newly added vulnerabilities are:

  • CVE-2025-39964: Linux Kernel Race Condition Vulnerability.
  • CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability.

Both vulnerabilities affect a fundamental component of the Linux operating system: the kernel, which manages system resources, memory, processes, hardware interactions, and access to privileged operating system functions.

Linux forms the foundation of critical infrastructure across enterprise servers, cloud environments, virtualisation platforms, network security appliances, embedded devices, and industrial systems. Consequently, kernel vulnerabilities deserve particular attention when evaluating the security of an organisation's infrastructure.

1. CVE-2025-39964: Linux Kernel Race Condition Vulnerability

CVE-2025-39964 involves a race condition within the Linux kernel.

A race condition occurs when the outcome of an operation depends on the timing or sequence of concurrent activities. When access to shared resources is not properly synchronised, an attacker may be able to trigger unintended behaviour by manipulating execution timing.

Depending on the vulnerable code path and exploitation prerequisites, race conditions can lead to problems such as:

  • Memory corruption or unintended changes to system state.
  • Unexpected process or kernel behaviour.
  • System instability and denial of service.
  • Security boundary violations, where supported by the particular flaw.

The precise impact of CVE-2025-39964 must be assessed against its technical advisory and the affected kernel versions. These are potential consequences of race conditions generally, not a claim that every listed outcome has been demonstrated for this CVE.

Why this matters

Kernel race conditions can be difficult to detect because exploitation may depend on precise timing and system conditions. Normal application-level monitoring may not reveal the underlying sequence of operations responsible for triggering the flaw.

The confirmed exploitation of this vulnerability makes identifying affected systems and applying the relevant kernel fixes an immediate security priority.

2. CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability

CVE-2026-53266 is an out-of-bounds write vulnerability affecting the Linux kernel.

An out-of-bounds write occurs when software writes data beyond the memory region allocated for a particular operation.

Such memory safety failures can corrupt adjacent memory and potentially affect other data structures or execution paths.

Depending on the specific vulnerability and available exploit primitives, the consequences of an out-of-bounds write may include:

  • Corruption of kernel memory.
  • Unexpected crashes or operating system instability.
  • Denial of service.
  • Potential exploitation of privileged execution paths.

It is important to distinguish these general risks from the confirmed capabilities of CVE-2026-53266. Its inclusion in the KEV Catalog establishes evidence of exploitation, but does not by itself establish that attackers have achieved arbitrary code execution or complete system compromise.

Why this matters

The Linux kernel operates in a highly privileged environment. Memory corruption within the kernel can therefore have serious security implications.

Organisations should not dismiss the vulnerability simply because affected systems are protected by conventional network security controls. The relevant attack prerequisites, affected configurations, and available patches must be evaluated individually.

3. Why CISA's KEV Inclusion Changes the Risk Assessment

The most significant aspect of this announcement is not merely the discovery of two Linux vulnerabilities. It is the confirmation that they have been exploited in real-world attacks.

Vulnerability databases contain thousands of security issues. However, a vulnerability's theoretical severity does not necessarily reflect the likelihood that attackers are actively targeting it.

CISA's KEV Catalog helps organisations identify vulnerabilities for which exploitation evidence already exists.

This distinction is crucial for vulnerability management.

An organisation relying entirely on CVSS scores could prioritise a theoretical critical vulnerability while leaving an actively exploited vulnerability unresolved.

KEV inclusion provides an additional, evidence-based signal for remediation decisions.

However, inclusion does not automatically establish that every Linux installation is vulnerable or that all affected installations are exposed to the same attack path.

The actual organisational risk depends on the affected kernel versions, attack prerequisites, configuration, exposure, existing controls, and importance of the affected system.

4. Implications for Enterprise Servers, Cloud Infrastructure, and Security Appliances

The announcement has implications for organisations operating Linux-based infrastructure.

Enterprise and application servers

Linux servers frequently host business applications, databases, authentication services, and other critical workloads.

Administrators should determine whether their installed kernel builds contain the vulnerable code and whether distribution-specific security updates have been released.

Cloud and virtualised environments

Organisations should evaluate affected Linux kernels across virtual machines, container hosts, and other relevant infrastructure.

A kernel vulnerability on a container host can present a different risk profile from an ordinary application vulnerability because containers commonly share the host's kernel.

Container image scanning alone may not establish whether the host kernel is vulnerable.

Network security appliances

Firewalls, intrusion prevention systems, VPN gateways, routers, and other security products frequently rely on Linux-based operating systems.

Security appliance vendors should evaluate their firmware against the vulnerable kernel code, determine whether affected functionality is present, and release corrective updates where required.

Customers should obtain vulnerability applicability statements from vendors rather than assume that an appliance is affected solely because it uses Linux.

Embedded and industrial systems

Embedded systems and industrial platforms may operate on customised or long-term-support kernel branches.

These environments require particular attention to vendor-supplied fixes, backported patches, compatibility testing, and maintenance planning.

A kernel version number alone may not conclusively establish vulnerability status because Linux distributions and appliance manufacturers often backport security fixes without changing the upstream kernel version.

5. Recommended Security Actions

Organisations should initiate a focused vulnerability response covering both CVEs.

Identify affected systems

Establish an inventory of Linux kernel builds across servers, cloud workloads, hypervisors, container hosts, network appliances, and embedded devices.

Compare installed kernel packages and firmware releases against the relevant vendor security advisories.

Prioritise remediation

Give priority to confirmed vulnerable systems based on their exposure, importance, exploit prerequisites, and the potential business impact of compromise.

Apply vendor-supported fixes and plan required system restarts to ensure patched kernels actually become active.

Investigate possible compromise

Since CISA reports active exploitation, administrators should not treat patch installation as the only necessary security action.

Review available host telemetry, authentication records, kernel messages, system crashes, unexpected privileged activity, suspicious process behaviour, and other relevant indicators.

These are general investigation measures, not CVE-specific indicators of compromise.

Where evidence suggests exploitation, follow the organisation's incident-response procedures and assess whether additional recovery measures are required.

Strengthen operating system security

Apply the principle of least privilege, restrict unnecessary access to sensitive systems, maintain appropriate kernel security settings, and ensure endpoint or host monitoring is enabled where supported.

These measures can help reduce exposure and improve detection, but they are not substitutes for correcting the underlying vulnerabilities.

Validate remediation

After updating, verify that the patched kernel is running and that the system is no longer affected according to its vendor's advisory.

For network appliances and specialised infrastructure, obtain confirmation of the fixed firmware release and whether a reboot or additional configuration change is necessary.

6. CISA's Risk-Based Vulnerability Management Requirements

CISA's announcement references Binding Operational Directive 26-04, which establishes risk-based vulnerability management requirements for U.S. Federal Civilian Executive Branch agencies.

The directive places particular emphasis on rapid remediation of high-risk vulnerabilities, including KEV-listed vulnerabilities affecting publicly exposed assets where exploitation provides full control.

It also establishes expectations for determining whether an affected system was compromised before remediation.

Although the directive applies to U.S. federal civilian agencies, its underlying approach is relevant to organisations worldwide: security remediation should consider demonstrated exploitation, asset exposure, potential impact, and evidence of compromise.

Organisations outside the United States can adopt similar principles without treating the directive as a legal obligation that automatically applies to them.

7. The Larger Security Lesson: Kernel Vulnerabilities Require More Than Routine Patch Management

The addition of CVE-2025-39964 and CVE-2026-53266 to CISA's KEV Catalog highlights an important challenge for enterprise security teams.

Kernel vulnerabilities affect a privileged layer of the operating system, and their remediation may require greater operational coordination than ordinary application updates.

Production servers may need maintenance windows. Security appliances may require vendor-tested firmware. Embedded devices may depend on manufacturers for backported fixes.

These operational complexities can create delays between the availability of a security update and its deployment.

Organisations should therefore maintain a clear process for identifying affected kernel builds, obtaining validated patches, scheduling updates, verifying installation, and conducting compromise assessments where appropriate.

Vulnerability management must extend beyond identifying vulnerabilities. It must also establish whether an organisation is affected, whether exploitation has occurred, and whether corrective actions have successfully eliminated the exposure.

Conclusion

CISA's September 18 announcement is an important reminder that actively exploited vulnerabilities must receive attention based on demonstrated threat activity.

CVE-2025-39964 and CVE-2026-53266 should prompt Linux administrators, cloud operators, infrastructure teams, and security appliance vendors to assess their exposure and apply relevant security updates.

The presence of these vulnerabilities in the KEV Catalog does not mean every Linux-based device is compromised. It does, however, establish that exploitation has occurred and that affected organisations should investigate and remediate their exposure without unnecessary delay.

The key takeaway: An actively exploited kernel vulnerability is not simply another entry in a vulnerability database. It is a reason to validate exposure, accelerate patching, and determine whether attackers have already taken advantage of the weakness.

Source: CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA via cisa.gov.