21 SEP 2026 — The US government added three Linux kernel flaws to its catalogue of actively exploited vulnerabilities on 18 September, and federal agencies have until 21 September to respond. The entries carry an extra order on top of patching: before closing the holes, agencies must look for evidence that somebody has already used them.
The entries do not say what to look for. They name no attacker, no victim, and no technique.
The three flaws
CVE-2025-39682 sits in the kernel's TLS receive path, where a zero-length record retrieved from the rx_list queue escapes the record-type handling that recvmsg() is supposed to apply. It affects kernel 6.0 through 6.16.3, plus the 6.17 release candidates, and is described as allowing memory disclosure or denial of service.
CVE-2026-53266 is an out-of-bounds write in the ebtables source network address translation path that rewrites ARP addresses. A local attacker can reach unintended system behaviour, denial of service, or escalation to higher privilege.
CVE-2025-39964 is a race condition in the kernel's cryptographic user API. Concurrent writes to the same AF_ALG socket are mishandled, and the result is either a crash or corrupted output from a cryptographic operation, which is the quieter and more unpleasant of the two outcomes.
What forensic triage requires
The obligation comes from Binding Operational Directive 26-04, which sorts vulnerabilities into tiers by risk rather than treating every entry the same way. The highest tier carries a three-day remediation window and, for some entries, an added requirement to carry out forensic triage of the affected asset to assess whether it has been compromised.
Triage is meant to happen before patching for a plain reason: applying a fix can disturb the evidence of a compromise. An agency that patches first and asks questions later may destroy the answer to whether anyone got in.
Agencies then have to produce a report covering an incident timeline, the actions taken in response to the notification, technical findings, containment and mitigation, and recommended next steps. All three catalogue entries reference the directive and its triage requirement.
Nobody has described the attack
A catalogue listing is the government's way of saying exploitation has been observed. The evidence behind that assertion has not been released. There is no threat actor, no targeted sector, and no indicators of compromise.
Red Hat has updated its advisories for all three to acknowledge active exploitation, rate them high risk, note that public exploits are known, and urge prioritised remediation. That confirms the seriousness without filling the gap, because a vendor advisory describes the flaw rather than the campaign.
Agencies are being told to hunt for an intrusion with no description of what it looks like. Triage under those conditions means checking the general signs — unexpected privilege changes, unexplained crashes in the relevant subsystems, gaps in logging — rather than matching a known pattern.
Two of them are older bugs
The identifiers are worth a second look. Two of the three were assigned in 2025 and one in 2026, so the majority of this listing concerns flaws that were found, catalogued and fixed upstream well before anyone reported them being used.
That lag is the ordinary condition rather than a failure. A kernel flaw becomes interesting to an attacker once a fix is published, because the fix reveals the bug. The window that matters is the time between a patch shipping and that patch being installed, and on a fleet of servers it is frequently measured in years.
One detail in the reporting does not reconcile. CVE-2025-39682 carries a 9.8 severity, and a score that high normally points to something reachable over a network by an unauthenticated attacker. That sits oddly next to a description naming local authenticated users. We could not resolve the inconsistency from what has been published, and we note it rather than pick a side.
The other kernel story this week
These three flaws are separate from the four Linux kernel local privilege escalation exploits that went public the same day. That other set — DirtyAH6, TUNderflow, PPPoEject and DiagSpill — has different identifiers, was reported to the kernel security team in mid-July, and carried no reports of attacks in the wild.
So one subsystem produced two clusters in one week, pointing in opposite directions. Four flaws had public working exploits and no observed attacks; three flaws had observed attacks and no public description. The second group carries the deadline.
What this means outside government
The directive binds federal civilian agencies and nobody else. The catalogue is still read far more widely than its legal scope, and the signal for a private fleet is the same: these three flaws are being used.
The distribution version is the number that matters, not the upstream release. Fixes flow through each distribution on its own schedule, and a kernel that reports a version above the affected upstream range may still be waiting on a vendor backport.
View author profile → · Editorial policy
