The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that three Linux kernel vulnerabilities are being actively exploited and added them to its Known Exploited Vulnerabilities (KEV) catalog on 18–19 September. Federal agencies have been ordered to patch by 21 September under Binding Operational Directive 26-04 — a short deadline that signals real, observed attacks rather than theoretical risk.
The three flaws sit in different parts of the kernel. CVE-2025-39682 (CVSS 9.8) is an improper-condition check in the TLS receive path that can expose memory or crash a system. CVE-2026-53266 (CVSS 8.8) is an out-of-bounds write in ebtables' SNAT ARP rewrite handling — relevant to any Linux box running firewall or network-address-translation rules — that can lead to a crash or privilege escalation. CVE-2025-39964 (CVSS 7.8) is a race condition in AF_ALG cryptographic sockets that can corrupt operations or crash the system. Red Hat has published advisories for all three and rated them high priority; CISA is also asking affected organisations to check for signs of compromise, not just install patches, since exploitation is confirmed rather than merely possible.
What this means for your business
You don't need to be a federal agency for this to matter. Linux runs the overwhelming majority of the world's web servers, VPS instances, and self-hosted business applications — from the shared hosting behind a company website to the Docker containers behind a custom app. If your business runs anything on Linux, whether that's a hosting provider's server, a self-managed VPS, or an on-premises firewall using ebtables/iptables rules, this week's task is simple: confirm your provider or IT team has applied the latest kernel security updates, and don't push it to the next scheduled maintenance window given confirmed active exploitation. If you use managed hosting, a quick message to your host asking "are your servers patched for the September Linux kernel KEV additions?" is a reasonable, specific question to ask. If you run your own servers, `uname -r` will show your current kernel version, which your sysadmin or developer can check against your distribution's latest security advisory. Confirmed in-the-wild exploitation, rather than a lab proof-of-concept, is what separates a "patch when convenient" bug from a "patch this week" one — this is the latter.