Summary
- CISA added CVE-2025-39964, CVE-2026-53266, and CVE-2025-39682 to its Known Exploited Vulnerabilities catalogue on 18 September.
- The issues include a race condition, an out-of-bounds write, and improper handling of exceptional conditions.
- Although CISA's mandatory deadlines apply to US federal agencies, the affected kernel technology is widely used across European server, cloud, and appliance estates.
Three Linux kernel vulnerabilities have been added to the US government’s Known Exploited Vulnerabilities catalogue after evidence of active attacks, shifting the flaws from conventional patch-management issues into vulnerabilities with demonstrated real-world exploitation.
The US Cybersecurity and Infrastructure Security Agency added CVE-2025-39964, CVE-2026-53266, and CVE-2025-39682 on 18 September. Two were announced together, with the third published in a separate catalogue update on the same date.
CVE-2025-39964 is described as a Linux kernel race-condition vulnerability, while CVE-2026-53266 is an out-of-bounds write affecting the kernel. CVE-2025-39682 concerns improper handling of unusual or exceptional conditions.
CISA only adds vulnerabilities to the catalogue when it has evidence that they have been exploited in the wild and mitigation guidance is available. The agency does not necessarily disclose who is exploiting a vulnerability, the number of affected organisations, or the campaign in which it was observed.
US federal civilian agencies are subject to specific remediation requirements under Binding Operational Directive 26-04. The mandate does not extend to UK or European organisations, but the exploitation evidence itself is relevant beyond the US federal environment because Linux is embedded across cloud infrastructure, servers, network equipment, appliances, containers, and other enterprise technology.
The catalogue entries also reflect a move towards vulnerability prioritisation based on observed attacker behaviour rather than severity scores alone. A flaw with active exploitation can require a different response from a nominally higher-scoring weakness for which no practical attack activity has been observed.
Kernel vulnerabilities deserve particular attention because the kernel sits beneath application controls and mediates access to memory, hardware, processes, and other operating-system resources. Successful exploitation can therefore be a route to privileges that allow an attacker to bypass restrictions enforced higher in the stack.
That does not mean every Linux system is equally exposed. Kernel version, distribution backports, architecture, configuration, required local access, and the vulnerable subsystem all determine whether a particular host can be exploited. Enterprise fleets can also contain distribution kernels whose version numbers do not map neatly to the upstream versions in which a fix first appeared.
The operational challenge is inventory. Linux frequently appears in places that are not managed like conventional employee endpoints, including virtual appliances, container hosts, network products, embedded systems, and specialised infrastructure. Organisations can therefore have vulnerable kernels inside assets owned by infrastructure, engineering, network, or product teams rather than a central server function.
CISA’s catalogue also requires US agencies to consider forensic triage for specified vulnerabilities under its newer risk-based directive. That distinction recognises that patching an already exploited weakness does not answer whether an attacker used it before the fix was applied.
For European organisations, the catalogue does not impose a legal patch deadline, but it provides a useful external indicator of attacker interest. The three additions narrow a large universe of Linux vulnerabilities to a smaller set for which active exploitation has been established by a government cyber agency.
The result is less a general Linux emergency than a prioritisation signal. The task is to identify where affected kernels exist, determine whether the vulnerable code paths are present and reachable, and distinguish patch deployment from investigation of systems that may already have been exposed.
