Linux kernel: three flaws in TLS, crypto sockets and ebtables used in attacks (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266)
CISA says attackers are using three Linux kernel flaws (CVE-2025-39682, CVE-2025-39964, CVE-2026-53266). Kernel fixes exist, but coverage varies by distribution and device. Update your Linux system, router or appliance firmware; ask the vendor if unsure.
Install your Linux distribution's latest kernel update and restart. For routers, NAS boxes and appliances built on Linux, install the maker's newest firmware, and if the device is no longer supported, plan to replace it.
- Linux kernelno fixed version yet
What’s happening
On 18 September 2026 CISA added three Linux kernel flaws to its list of vulnerabilities being used in attacks. CVE-2025-39682 is a logic error in the kernel's TLS receive code, where a zero-length record can cause later records to be handled wrongly. CVE-2025-39964 is a race condition in AF_ALG, the kernel's crypto socket interface, that can corrupt socket state. CVE-2026-53266 is an out-of-bounds write in the ebtables SNAT target that can alter file-backed memory. Reports say these can lead to crashes, memory exposure or local privilege escalation, though CISA released no details of the attacks or who is behind them. Red Hat reports public exploits exist. CISA marked all three for forensic triage and said none is known to be used by ransomware gangs. Fixes are in the upstream kernel, and Siemens lists SIMATIC CN 4100 V5.0. CISA warns some affected products may be end-of-life. Which fixed kernel your device runs depends on the distribution or maker, so check its advisory. The exact fixed kernel version numbers were not confirmed from a primary page.
- What
- Flaw
- Affects
- Linux kernel (including distributions and devices that ship it, such as Siemens SIMATIC CN 4100)
- Affected
- Linux kernel (versions before the upstream stable fixes for each CVE)
Siemens SIMATIC CN 4100 (before V5.0) - Fixed in
- Upstream Linux stable-tree fixes (per-CVE commits)
Siemens SIMATIC CN 4100 V5.0 - Since
- 18 Sept 2026
Timeline
- Update
Qualys set out the CISA deadlines: 21 September for CVE-2025-39682 on all systems, and 21 September (internet-facing) and 2 October (internal) for the other two. It noted Red Hat reports public exploits for all three.
- Update
BleepingComputer reported that CISA gave US federal agencies until that day to apply fixes or mitigations, and marked all three for forensic triage, meaning agencies must check for signs they were already exploited. None was flagged as used by ransomware gangs.
- CISA added
CISA added three Linux kernel flaws to its Known Exploited Vulnerabilities list: CVE-2025-39682 (kernel TLS), CVE-2025-39964 (AF_ALG crypto sockets) and CVE-2026-53266 (ebtables SNAT). No details of the attacks were released.
Sources
- CISA alerts of active exploitation of three Linux kernel flawsBleepingComputer · 21 Sept 2026
- CISA BOD 26-04 Timelines for Three Linux Kernel CVEsQualys · 23 Sept 2026