CISA adds three actively exploited Linux Kernel flaws to KEV: CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que a fonte trouxe em 29/10/2026 00:02; os links antigos trazem para cá.
Fontes: cisa.gov ×2 ↗
CISA added three Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on evidence of active exploitation, in two alerts published on 2026-09-18 (cisa.gov). The first alert covers CVE-2025-39682, an Improper Check for Unusual or Exceptional Conditions flaw. The second covers CVE-2025-39964, a race condition, and CVE-2026-53266, an out-of-bounds write. CISA calls these vulnerability types a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. Neither alert gives exploitation details, affected kernel versions, IOCs, victim information or threat actor attribution. Both restate BOD 26-04, which requires Federal Civilian Executive Branch (FCEB) agencies to prioritize rapid remediation, and CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.
Entenda a falha
A vulnerabilidade
CISA added three Linux Kernel flaws to its KEV Catalog on 2026-09-18, citing evidence of active exploitation. CVE-2026-53266 is an out-of-bounds write. CVE-2025-39964 is a race condition. CVE-2025-39682 is an Improper Check for Unusual or Exceptional Conditions. The alerts do not give the affected component, the affected or fixed kernel versions, what an attacker needs (local or remote access, privileges, configuration) or what exploitation yields. Check the kernel and distribution advisories for versions and fixes.
Como funciona
The CISA alerts do not describe how the vulnerable code path works, so the exact sequence of events is not public in these sources. They only name the weakness classes. An out-of-bounds write means the kernel writes data outside the memory it should touch. A race condition means two operations interfere because of timing. A missing check for unusual conditions means the kernel does not handle an exceptional state correctly. Which kernel subsystem or input is involved is not stated.
Por que é vulnerável
The sources give only the weakness types, not the root causes in code. They are: improper checking of unusual or exceptional conditions (CVE-2025-39682), a race condition (CVE-2025-39964) and an out-of-bounds write (CVE-2026-53266). They do not explain why the flaws went unnoticed or what the fixes change.
Como foi descoberta
According to CISA, all three flaws were added to the KEV Catalog based on evidence of active exploitation, in two alerts published on 2026-09-18. The alerts do not say who found the flaws, how or when they were reported, who is exploiting them, or whether they are used together. They give no IOCs or victim information.
Explicação gerada por IA a partir da matéria e dos artigos, em 29/10/2026 00:17.
Detalhes técnicos
- CVE-2025-39682: Linux Kernel, Improper Check for Unusual or Exceptional Conditions (CWE-754 class as named by CISA) (cisa.gov).
- CVE-2025-39964: Linux Kernel Race Condition Vulnerability (cisa.gov).
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability (cisa.gov).
- The alerts do not name affected kernel versions, exploitation methods, the impact of exploitation, IOCs or threat actors. They also do not say whether the flaws are chained or exploited together.
Remediação
- Prioritize remediation of all three CVEs on Linux systems, especially publicly exposed assets.
- Under BOD 26-04, FCEB agencies must rapidly remediate KEV-listed CVEs on publicly exposed assets that grant total control after exploitation. The directive also sets expectations for checking whether threat actors compromised a system before the patch was applied (cisa.gov).
- The CISA alerts list no specific patches or mitigations. Consult the Linux kernel and distribution vendor advisories for affected versions and fixes.
Linha do tempo
-
CISA adds Linux Kernel CVE-2025-39964 and CVE-2026-53266 to KEV catalog over active exploitation
ler a análise desta fonte ocultar
CISA added two Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2025-39964, a race condition flaw, and CVE-2026-53266, an out-of-bounds write flaw. CISA describes these vulnerability types as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no exploitation details, threat actor attribution, victim information or IOCs. It restates the requirements of BOD 26-04 for Federal Civilian Executive Branch (FCEB) agencies, and CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.
Technical Details
- CVE-2025-39964: Linux Kernel Race Condition Vulnerability.
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability.
- The article does not list affected kernel versions, exploitation methods, the impact of exploitation or whether the flaws are chained.
Remediation
- Under BOD 26-04, FCEB agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation.
- BOD 26-04 also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
- CISA encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities.
- The article gives no specific patch or mitigation guidance; consult the Linux kernel and distribution vendor advisories.
-
CISA adds Linux Kernel improper check flaw CVE-2025-39682 to KEV catalog on evidence of active exploitation
ler a análise desta fonte ocultar
CISA added one vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on 2026-09-18 based on evidence of active exploitation: CVE-2025-39682, an Improper Check for Unusual or Exceptional Conditions flaw in the Linux Kernel. CISA describes this vulnerability type as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no technical details, affected versions, exploitation specifics or attribution.
The alert also references BOD 26-04, which requires FCEB agencies to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control after exploitation. It further sets expectations for checking whether threat actors compromised a system before the patch was applied. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.
Technical Details
- CVE-2025-39682: Linux Kernel, Improper Check for Unusual or Exceptional Conditions (CWE-754 class as named by CISA).
- The article does not name affected kernel versions, exploitation methods, IOCs or threat actors.
Remediation
- Prioritize remediation of CVE-2025-39682 on Linux systems, especially publicly exposed assets.
- Consult the Linux kernel and distribution vendor advisories for affected versions and patches; the CISA alert does not list them.
- Per BOD 26-04, check whether systems were compromised before the patch was applied.