Linux Kernel KEV Trio: kTLS, ebtables, AF_ALG — Federal Due September 21

Monday’s patch clock is a reboot clock. CISA put three actively exploited Linux kernel bugs on the KEV catalog Friday with a September 21 federal due date — and every one of them needs a kernel update plus a reboot (or a verified live-patch) before you call it done.

What happened

On September 18, 2026, CISA added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities catalog, all with evidence of active exploitation and a BOD 26-04 remediation deadline of September 21, 2026. Forensic triage is required.

• CVE-2025-39682 — Improper check in the kernel TLS (kTLS) receive path (tls_sw_recvmsg). A zero-length record from rx_list can bypass intended record-type handling and, in zero-copy mode, corrupt socket-buffer reference counts (use-after-free class impact). Public proof-of-concept material has circulated; Red Hat and upstream stable trees have fixes.
• CVE-2026-53266 — Out-of-bounds write in the bridge netfilter ebtables SNAT target when rewriting ARP sender hardware addresses into a nonlinear skb fragment.
• CVE-2025-39964 — Race condition allowing concurrent writers on the same AF_ALG crypto socket, producing inconsistent per-socket state (memory disclosure / DoS / privilege-escalation class outcomes depending on context).

CISA’s September 18 alert text named the ebtables and AF_ALG entries explicitly; the KEV JSON also lists the kTLS flaw with the same add date and Monday due date. Treat all three as one Monday work package.

Why it matters

Local kernel privilege escalation is how a foothold you already absorbed becomes a reportable incident. These are not “internet worm” unauth RCEs — they are the second half of the intrusion, and they hit the subsystems that high-throughput Linux estates actually enable: kTLS offload on proxies/CDNs/databases, bridge ebtables in virtualized/container networks, and AF_ALG for kernel-mediated crypto.

BOD 26-04’s three-day clock plus forensic triage means “patched” is not the finish line. You still need to ask whether the box was dirty before the reboot.

What to do first

• Inventory kernel versions across the estate (especially internet-facing and multi-tenant Linux). Map which hosts enable kTLS, ebtables SNAT, or AF_ALG.
• Apply vendor kernel updates covering all three CVEs. Confirm live-patch coverage (kpatch / Canonical Livepatch / vendor equivalent) before assuming you can defer reboots.
• Schedule the reboot window now — Monday morning is already late for FCEB; private-sector operators should treat the same clock as operational priority.
• Prioritize kTLS-enabled edge and multi-tenant hosts for CVE-2025-39682.
• Restrict CAP_NET_ADMIN and audit ebtables SNAT/ARP rewrite rules for CVE-2026-53266.
• If you cannot patch immediately for CVE-2025-39964, evaluate blacklisting af_alg (understand the crypto-offload blast radius first).
• After patch: forensic triage — kernel crash logs, KASAN/oops history, and audit trails for privilege-escalation symptoms in the pre-patch window (PoC age on the kTLS bug makes that window long).

Details

• Ransomware use (CISA): Unknown for all three
• Workarounds: Limited — config-only options degrade or disable features; kernel update is the real fix
• Example fixed trains (verify against your vendor): RHEL advisories cited in public reporting include RHSA-2025:16880 / RHSA-2025:16904 (kTLS) and RHSA-2026:36645 / 39082 / 39083 (ebtables). Upstream stable commits are linked from the KEV notes.

Hunt / verify

• Confirm running kernel package/version matches a fixed build — not merely “updates applied.”
• Identify kTLS users: apps calling setsockopt(SOL_TCP, TCP_ULP, "tls"); nginx/OpenSSL kTLS configs; ss/telemetry for TLS ULP.
• Review ebtables rulesets for SNAT targets touching ARP.
• Check whether af_alg is loaded; watch for anomalous multi-writer patterns on AF_ALG sockets.
• Review dmesg/journal for UAF/oops patterns consistent with the kTLS PoC class before declaring clean.

Sources

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog
• https://nvd.nist.gov/vuln/detail/CVE-2025-39682
• https://nvd.nist.gov/vuln/detail/CVE-2026-53266
• https://nvd.nist.gov/vuln/detail/CVE-2025-39964
• https://www.techtimes.com/articles/327741/20260919/cisa-flags-three-actively-exploited-linux-kernel-flaws-orders-federal-patch-sunday.htm

George Bailey

George Bailey is a cybersecurity researcher and writer at CyberExperts, covering cyber threats, AI, cloud security, vulnerabilities, and defensive strategies. His goal is to help security professionals quickly understand what matters most and how it impacts their organizations.