{"id":"linux-kernel-tls-algif-ebtables-kev-sep-2026","category":"patch","status":"live","title":"Linux kernel: three flaws in TLS, crypto sockets and ebtables used in attacks (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266)","tldr":"CISA says attackers are using three Linux kernel flaws (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266). Kernel fixes exist, but coverage varies by distribution and device. Update your Linux system, router or appliance firmware; ask the vendor if unsure.","summary":"On 18 September 2026 CISA added three Linux kernel flaws to its list of vulnerabilities being used in attacks. CVE-2025-39682 is a logic error in the kernel's TLS receive code, where a zero-length record can cause later records to be handled wrongly. CVE-2025-39964 is a race condition in AF_ALG, the kernel's crypto socket interface, that can corrupt socket state. CVE-2026-53266 is an out-of-bounds write in the ebtables SNAT target that can alter file-backed memory. Reports say these can lead to crashes, memory exposure or local privilege escalation, though CISA released no details of the attacks or who is behind them. Red Hat reports public exploits exist. CISA marked all three for forensic triage and said none is known to be used by ransomware gangs. Fixes are in the upstream kernel, and Siemens lists SIMATIC CN 4100 V5.0. CISA warns some affected products may be end-of-life. Which fixed kernel your device runs depends on the distribution or maker, so check its advisory. The exact fixed kernel version numbers were not confirmed from a primary page.","action":"Install your Linux distribution's latest kernel update and restart. For routers, NAS boxes and appliances built on Linux, install the maker's newest firmware, and if the device is no longer supported, plan to replace it.","product":"Linux kernel (including distributions and devices that ship it, such as Siemens SIMATIC CN 4100)","audience":"both","severity":"high","patch":"partial","exploited":true,"cves":["CVE-2025-39682","CVE-2025-39964","CVE-2026-53266"],"tags":["linux","linux-kernel","kev","cisa","privilege-escalation","tls","netfilter","exploited"],"affected":["Linux kernel (versions before the upstream stable fixes for each CVE)","Siemens SIMATIC CN 4100 (before V5.0)"],"fixed":["Upstream Linux stable-tree fixes (per-CVE commits)","Siemens SIMATIC CN 4100 V5.0"],"matches":[{"platform":"linux","app":"Linux kernel","bundle":"","fixed":""}],"sources":[{"kind":"news","title":"CISA alerts of active exploitation of three Linux kernel flaws","url":"https://www.bleepingcomputer.com/news/security/cisa-alerts-of-active-exploitation-of-three-linux-kernel-flaws/","by":"BleepingComputer","date":"2026-09-21"},{"kind":"research","title":"CISA BOD 26-04 Timelines for Three Linux Kernel CVEs","url":"https://blog.qualys.com/product-tech/2026/09/23/cisa-bod-26-04-timelines-for-three-linux-kernel-cves","by":"Qualys","date":"2026-09-23"}],"started":"2026-09-18","closed":null,"created":"2026-11-03T22:08:00.336Z","updated":"2026-11-03T22:08:00.336Z","cve_notes":[{"cve":"CVE-2025-39682","name":"Logic flaw in Linux kernel TLS receive path","what":"A flaw in the kernel's TLS receive code lets a zero-length record skip the intended record-type handling, so later TLS records are processed wrongly, which reports link to memory exposure or crashes.","severity":"critical","cvss":9.8},{"cve":"CVE-2025-39964","name":"Race condition in Linux kernel AF_ALG crypto sockets","what":"A race condition in AF_ALG, the kernel's cryptographic socket interface, where simultaneous writes to one socket scramble its internal state and can crash the system or corrupt results.","severity":"medium","cvss":5.5},{"cve":"CVE-2026-53266","name":"Out-of-bounds write in Linux ebtables SNAT target","what":"An out-of-bounds write in the ebtables SNAT network-filtering code that, through an address rewrite on a crafted ARP packet, writes into file-backed memory and could crash a system or help a local attacker gain higher privileges.","severity":"high","cvss":8.8}],"timeline":[{"at":"2026-09-23","added":"2026-11-03T22:05:25.250Z","kind":"other","text":"Qualys set out the CISA deadlines: 21 September for CVE-2025-39682 on all systems, and 21 September (internet-facing) and 2 October (internal) for the other two. It noted Red Hat reports public exploits for all three.","url":"https://blog.qualys.com/product-tech/2026/09/23/cisa-bod-26-04-timelines-for-three-linux-kernel-cves","by":"Qualys","patch":null},{"at":"2026-09-21","added":"2026-11-03T22:05:25.250Z","kind":"other","text":"BleepingComputer reported that CISA gave US federal agencies until that day to apply fixes or mitigations, and marked all three for forensic triage, meaning agencies must check for signs they were already exploited. None was flagged as used by ransomware gangs.","url":"https://www.bleepingcomputer.com/news/security/cisa-alerts-of-active-exploitation-of-three-linux-kernel-flaws/","by":"BleepingComputer","patch":null},{"at":"2026-09-18","added":"2026-11-03T22:05:25.250Z","kind":"cisa-added","text":"CISA added three Linux kernel flaws to its Known Exploited Vulnerabilities list: CVE-2025-39682 (kernel TLS), CVE-2025-39964 (AF_ALG crypto sockets) and CVE-2026-53266 (ebtables SNAT). No details of the attacks were released.","url":"https://www.bleepingcomputer.com/news/security/cisa-alerts-of-active-exploitation-of-three-linux-kernel-flaws/","by":"BleepingComputer","patch":null}],"url":"https://hard.fyi/live/linux-kernel-tls-algif-ebtables-kev-sep-2026/","json":"https://hard.fyi/api/live?id=linux-kernel-tls-algif-ebtables-kev-sep-2026"}