Linux Kernel KEV Trio: kTLS, ebtables, AF_ALG — Federal Due September 21

Monday’s patch clock is a reboot clock. CISA put three actively exploited Linux kernel bugs on the KEV catalog Friday with a September 21 federal due date. Every one of them needs a kernel update plus a reboot (or a verified live-patch) before you call it done.

Three kernel bugs on KEV, due September 21

On September 18, 2026, CISA added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities catalog, all with evidence of active exploitation and a BOD 26-04 remediation deadline of September 21, 2026. Forensic triage is required.

• CVE-2025-39682 — Improper check in the kernel TLS (kTLS) receive path (tls_sw_recvmsg). A zero-length record from rx_list can bypass intended record-type handling and, in zero-copy mode, corrupt socket-buffer reference counts (use-after-free class impact). Public proof-of-concept material has circulated; Red Hat and upstream stable trees have fixes.
• CVE-2026-53266 — Out-of-bounds write in the bridge netfilter ebtables SNAT target when rewriting ARP sender hardware addresses into a nonlinear skb fragment.
• CVE-2025-39964 — Race condition allowing concurrent writers on the same AF_ALG crypto socket, producing inconsistent per-socket state (memory disclosure / DoS / privilege-escalation class outcomes depending on context).

CISA’s September 18 alert text named the ebtables and AF_ALG entries explicitly; the KEV JSON also lists the kTLS flaw with the same add date and Monday due date. Treat all three as one Monday work package.

Local privilege escalation finishes the intrusion

Local kernel privilege escalation is how a foothold you already absorbed becomes a reportable incident. These are not internet-worm unauth RCEs. They are the second half of the intrusion. They hit subsystems high-throughput Linux estates actually enable: kTLS offload on proxies, CDNs and databases; bridge ebtables in virtualized and container networks; and AF_ALG for kernel-mediated crypto.

BOD 26-04’s three-day clock plus forensic triage means “patched” is not the finish line. You still need to ask whether the box was dirty before the reboot.

Patch, reboot or live-patch, then triage

• Inventory kernel versions across the estate (especially internet-facing and multi-tenant Linux). Map which hosts enable kTLS, ebtables SNAT, or AF_ALG.
• Apply vendor kernel updates covering all three CVEs. Confirm live-patch coverage (kpatch / Canonical Livepatch / vendor equivalent) before assuming you can defer reboots.
• Schedule the reboot window now. Monday morning is already late for FCEB. Private-sector operators should treat the same clock as operational priority.
• Prioritize kTLS-enabled edge and multi-tenant hosts for CVE-2025-39682.
• Restrict CAP_NET_ADMIN and audit ebtables SNAT/ARP rewrite rules for CVE-2026-53266.
• If you cannot patch immediately for CVE-2025-39964, evaluate blacklisting af_alg (first understand what crypto offload you will lose).
• After patch: forensic triage. Check kernel crash logs, KASAN/oops history, and audit trails for privilege-escalation symptoms in the pre-patch window. PoC age on the kTLS bug makes that window long.

Details

• Ransomware use (CISA): Unknown for all three
• Workarounds: Limited. Config-only options degrade or disable features; a kernel update is the real fix
• Example fixed trains (verify against your vendor): RHEL advisories cited in public reporting include RHSA-2025:16880 / RHSA-2025:16904 (kTLS) and RHSA-2026:36645 / 39082 / 39083 (ebtables). Upstream stable commits are linked from the KEV notes.

Hunt / verify

• Confirm running kernel package/version matches a fixed build. “Updates applied” is not enough.
• Identify kTLS users: apps calling setsockopt(SOL_TCP, TCP_ULP, "tls"); nginx/OpenSSL kTLS configs; ss/telemetry for TLS ULP.
• Review ebtables rulesets for SNAT targets touching ARP.
• Check whether af_alg is loaded; watch for anomalous multi-writer patterns on AF_ALG sockets.
• Review dmesg/journal for UAF/oops patterns consistent with the kTLS PoC class before declaring clean.

Sources

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog
• https://nvd.nist.gov/vuln/detail/CVE-2025-39682
• https://nvd.nist.gov/vuln/detail/CVE-2026-53266
• https://nvd.nist.gov/vuln/detail/CVE-2025-39964
• https://www.techtimes.com/articles/327741/20260919/cisa-flags-three-actively-exploited-linux-kernel-flaws-orders-federal-patch-sunday.htm

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].