CISA Put Three Linux Kernel Bugs on the Exploited List. Two Sit Under Your Containers.

CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on 18 September 2026. The remediation deadline for federal civilian agencies landed on 21 September. That is one weekend to patch, or to apply a mitigation, across every affected host.

Red Hat updated its advisories early on 19 September and confirmed known public exploits against all three. The vendor position is not subtle. Fix the kernel, or remove the configuration that makes the flaw reachable. The catalog entry also asks for forensic triage under CISA risk-based patching guidance, because a bug that was exploited in the wild may already have been used.

The kernel TLS flaw is the one with a network vector

CVE-2025-39682 sits in the kernel TLS receive path. A zero-length record pulled off the rx_list bypasses the record-type handling that recvmsg() is meant to apply, so the records after it get processed on wrong zero-copy and queuing assumptions. NVD scores it 9.8 on the network vector. Red Hat is more specific, calling it remotely triggerable only when kernel TLS is in use.

That qualifier narrows the blast radius. It does not dismiss the bug. Kernel TLS moves record handling into the kernel so a dataplane can offload encryption and skip a user-space copy. Stacks that make that choice include ingress controllers and service proxies. Where it is on, an attacker has a remote memory disclosure path. Where it is off, the same bug stays local.

Bridge ebtables sits in the container network path

CVE-2026-53266 is the one to read twice. The ebtables SNAT target rewrites the Ethernet source address behind a writability check, because at the bridge hooks the Ethernet header is reached through skb_mac_header() while skb->data points at the payload. The optional ARP sender hardware address rewrite skips that safety. It writes into a nonlinear socket buffer fragment backed by a splice-imported file page.

Red Hat rates the flaw Important, with memory corruption, denial of service and local privilege escalation in reach. NVD scores it 8.8 and marks the scope change, which fits a write that escapes the socket buffer into a shared page. Bridge netfilter is how container and virtual machine networks get address translation and filtering, so these rules are common on the hosts that run pods. The mitigation is to disable ARP hardware address rewriting in ebtables SNAT rules, or to remove the SNAT rules that touch ARP traffic on bridge interfaces.

Patching the kernel is the easy half

CVE-2025-39964 is the quietest of the three. Two threads writing to the same af_alg socket interleave their request payloads unpredictably, which leaves the socket context inconsistent. The upstream fix adds a ctx->write field that grants one writer exclusive ownership. NVD scores it 7.8 on the local vector, so the bar is a process on the host or inside a container with the right setup.

Kernel patching has a shape that package patching does not. The package upgrade is the small part. Every node runs the affected kernel, and a running kernel does not change until the node is rebooted or replaced. On a cluster that means draining and recycling nodes, the same slow step that volume and node hardening work keeps running into. It is also why the privilege escalation bugs disclosed on 18 September landed as the same story from a different angle.

Treat the deadline as a signal even if you are not a federal agency. A weekend window existed for the people who had to move first, and it existed because someone confirmed the exploits were real. Check the kernel on your nodes, check whether kernel TLS is offloaded and whether ARP rewriting is configured on bridge interfaces, then plan the recycle. The last time CISA flagged infrastructure as exploited, the gap between the advisory and the incident was measured in days.