As cited
Copy frozen at (site build).
vulnerabilities
CISA BOD 26-04 Timelines for Three Linux Kernel CVEs
CISA added three actively exploited Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on September 18, 2026: CVE-2025-39682 (TLS zero-length record flaw), CVE-2026-53266 (Netfilter ebtables out-of-bounds write), and CVE-2025-39964 (AF_ALG socket race condition). Remediation deadlines of September 21 for CVE-2025-39682 and publicly exposed instances of the other two have already passed, with internal systems facing an October 2 deadline under CISA BOD 26-04. All three require immediate patching due to confirmed active exploitation and potential kernel-level compromise.
Why it matters: Organizations running Linux systems must patch these kernel vulnerabilities immediately or face compliance violations under CISA BOD 26-04; exploitation can compromise entire systems rather than isolated applications, making this a critical infrastructure and enterprise risk.
- Source published
- First seen by Cybersecurity Tracker