CISA Orders Federal Agencies to Patch Three Actively Exploited Linux Kernel Flaws by Sunday

The Cybersecurity and Infrastructure Security Agency gave federal civilian agencies a 72-hour clock this week to patch three Linux kernel vulnerabilities that hackers are already exploiting in the wild.

CISA's own alert, dated Friday, September 18, is titled "CISA Adds Two Known Exploited Vulnerabilities to Catalog" and names CVE-2025-39964 and CVE-2026-53266. Multiple outlets covering the same news cycle, including Tech Times, The Hacker News and Cybersecurity News, report that a third flaw, CVE-2025-39682, landed in the catalog as well, bringing the total to three and setting the same September 21 deadline for all of them under Binding Operational Directive 26-04. CISA's public notice does not explain the discrepancy, and records available to date do not clarify whether CVE-2025-39682 was added in a separate action folded into the same deadline window.

The severity is clear. CVE-2025-39682 carries a CVSS score of 9.8 out of 10, according to Cybersecurity News and blog.actipace. It's an improper-check flaw in the kernel's TLS receive path, the code that handles kernel-level TLS decryption, known as kTLS, on high-throughput Linux servers like content delivery networks and reverse proxies. Red Hat's advisory says the flawed code path can be triggered remotely when kTLS is enabled, which is why internet-facing systems using the feature are the top remediation priority.

The second flaw, CVE-2026-53266, scores 8.8 and hits the netfilter bridge ebtables SNAT target used in network address translation setups. Cybersecurity News reports the kernel can fail to verify a memory range is writable during an Address Resolution Protocol rewrite, opening the door to memory corruption, denial of service, or local privilege escalation. The third, CVE-2025-39964, is a 7.8-severity race condition in the kernel's AF_ALG cryptographic interface that can crash a system or corrupt cryptographic results when two processes write to the same socket at once, according to blog.actipace.

Red Hat updated its advisories for all three vulnerabilities on September 19 to formally acknowledge active exploitation, per The Hacker News, warning that "known public exploits" exist and urging organizations to "address this vulnerability with high priority."

None of the sources currently reporting on this have published technical detail on exactly how attackers are exploiting the three bugs, or whether they're being chained together in a single attack, according to both blog.actipace and The Hacker News. CISA has also flagged all three for forensic triage, meaning covered agencies have to investigate whether systems were already compromised before the patch went in, not just install the fix, according to Cybersecurity News.

Why the 72-hour clock matters

BOD 26-04, issued June 10, 2026, reserves its tightest deadlines for vulnerabilities that hit all four of CISA's top risk markers at once: the flaw sits on an internet-exposed asset, exploitation is confirmed, the exploit can be automated, and it can lead to full system compromise. Tech Times reports all three of this week's additions clear that bar.

The backdrop makes the deadline more than bureaucratic theater. The 2026 Verizon Data Breach Investigations Report, cited by Tech Times, found only 26% of KEV-listed vulnerabilities were fully remediated in 2025, down from 38% the year before, with the median time to full remediation stretching to 43 days. A three-day window against that track record is an aggressive ask.

Separately, security researcher Asim Manizada disclosed four other local privilege escalation flaws in the Linux kernel around the same time, tracked as CVE-2026-80844, CVE-2026-81000, CVE-2026-68121 and CVE-2026-74469, according to The Hacker News. Those have not been added to the KEV catalog and there's no confirmed exploitation tied to them yet, but the disclosures underline that kernel-level bugs are surfacing at a steady clip this year.

The wider pattern: routers, industrial controllers, and AI-sped attacks

This KEV addition isn't happening in isolation. Cybersecurity firm Sygnia reported on August 27 that a China-linked group it tracks as Fire Ant compromised Cisco routers, suppressed logs to hide from administrators, captured login credentials, and used the devices to probe other high-value networks, according to the Epoch Times. Sygnia has not named affected organizations or confirmed a U.S. victim, and it did not identify a specific Cisco vulnerability used in the intrusions. Cisco issued a separate hardening update for its IOS XR router software on September 2 addressing seven groups of flaws found through internal testing, unrelated to Sygnia's findings, the Epoch Times reported.

On the AI front, OpenAI warned on August 10 that attackers will increasingly use AI to run cyberattacks at what it called "unprecedented speed and scale," according to Fox News, and said its own cyber-focused model now answers 95% of advanced exploit-development requests it previously refused. Days later, on August 19, the NSA, CISA, the FBI, the Department of Energy and the EPA jointly warned that hackers are targeting Siemens S7 industrial controllers, which run real machinery in power, water and manufacturing plants, using AI-generated exploitation scripts, Fox News reported. That timeline suggests federal agencies see AI as compressing the time defenders have to patch known flaws before they're weaponized, which is exactly the pressure this week's 72-hour Linux deadline reflects.

CISA has not said which threat actors are behind the exploitation of the three Linux flaws, how many federal systems run affected kernel versions, or whether any agency has already found evidence of compromise under the mandated forensic review. The directive applies only to federal civilian agencies, though CISA is urging all organizations running affected kernels to patch on the same timeline.