CISA added two Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on 18 September, saying it has evidence both are being used in real attacks. Both were fixed upstream months ago. The catalog entries do not say who is exploiting them, against whom, or how.
The heavier of the two is CVE-2026-53266, scored 8.8 at NVD, an out-of-bounds write in the kernel's bridge netfilter code. The kernel's own commit record describes the fix as making the ebtables SNAT target's optional ARP sender hardware address rewrite writable before anything is written to it. CVE-2025-39964 carries a 7.8 and sits in the crypto subsystem, where the af_alg socket interface permitted two writes to the same socket at once. The fix disallows that by adding a flag marking exclusive ownership of the write.
Both published CVSS vectors describe a local attack vector requiring low privileges, which means an attacker needs some existing access to the machine before either flaw is reachable. Beyond the fact of exploitation, CISA's alert carries no detail at all: a CVE ID, a vulnerability class and the standard directive boilerplate. The vendor and distribution advisories are where the specifics live.
Old fixes, new urgency
Neither bug is fresh. NVD published the record for CVE-2025-39964 on 13 October 2025 and for CVE-2026-53266 on 25 June 2026, and both track patches already merged upstream. What changed this week is CISA's assertion that they are being used, which is the entire purpose of the catalog. Kernel fixes reach real machines through distribution packages, so the distance between an upstream merge and a patched production host is routinely measured in weeks.
What the federal clock actually covers
Binding Operational Directive 26-04 governs the response for federal civilian agencies. It directs them to prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation, and to defer lower-risk items rather than treat everything as urgent. It also sets expectations for checking whether attackers got in before the patch was applied. Private organizations are not bound by it, though CISA encourages everyone to adopt the same risk-based approach. You can read CISA's alert and the NVD records for both CVEs directly.
Confirm the running kernel, not the package
The remedy for both is the kernel update from your distribution, and the step teams get wrong is verifying the installed version rather than the booted one. A host that has taken the package but has not rebooted is still running the vulnerable kernel. Because BOD 26-04 also asks about compromise that predates the patch, anyone with exposed Linux fleets should treat this listing as a prompt to review local activity on those hosts, not only to update them.
CISA's previous kernel entry came in August, bundled with ownCloud and JFrog Artifactory flaws, and a separate Open vSwitch issue handed local users root across most distributions in the same month. Local kernel bugs are rarely the way in. They are what turns a modest foothold into a serious one.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.