CISA KEV Linux Kernel Alert September 2026: Patch CVE-2025-39682 and CVE-2026-53266 Now

CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on September 18, 2026 — and set a federal remediation deadline of September 21. That deadline is now past. For the CISA KEV Linux kernel September 2026 batch, the three CVEs target the AF_ALG crypto socket subsystem and the netfilter ebtables SNAT module. Beyond these three, four additional Linux local privilege escalation exploits with public proof-of-concept code also dropped in the same week. This means September 2026 is shaping up as the busiest single month for Linux kernel security patches in 2026 — a year that has already seen Copy Fail, Dirty Frag, GhostLock, SCTPhantom, and a dozen other exploited kernel flaws. This post covers all three CISA KEV Linux CVEs, the September LPE wave, how to check your exposure, and exactly how to patch on every major distribution today.

What CISA KEV Means and Why Non-Federal Admins Must Act Too

The CISA Known Exploited Vulnerabilities catalog is not a theoretical risk list. CISA only adds entries when there is credible, confirmed evidence of active exploitation in the wild — not just published proof-of-concept code. Because the September 18 addition of three Linux kernel CVEs with a September 21 deadline confirms that real attackers are running these exploits against real systems right now, the urgency applies equally to private-sector and government environments.

Federal agencies had until September 21 to remediate. For the rest of us, the exploitation evidence is what matters. Since attackers do not check whether your organization is a federal agency before exploiting a kernel vulnerability, the practical response is identical: patch immediately, verify the patched kernel is running, and confirm via the CVE changelog. Below is a breakdown of all three CVEs, their attack surfaces, and the patch commands for every major Linux distribution.

The Three CISA KEV Linux Kernel CVEs: September 2026

CVE-2025-39682 and CVE-2025-39964: AF_ALG Crypto Socket Flaws

Both CVEs sit in the AF_ALG subsystem — the kernel interface that exposes hardware cryptographic acceleration to userspace applications. Because AF_ALG is enabled by default on essentially every major Linux distribution and is used by OpenSSL, libgcrypt, and other common crypto libraries, the attack surface is broad across both servers and desktops.

CVE-2025-39682 is a use-after-free condition in the AF_ALG socket release path. When an AF_ALG socket is closed while a pending async crypto operation is still in flight, the kernel can access memory that has already been freed. An attacker who can time socket operations correctly can exploit this to gain kernel read/write access and escalate to root.

CVE-2025-39964 is a related memory type confusion issue in the same AF_ALG code path. Specifically, certain AF_ALG socket types allow a user to splice pages between socket buffers in a way that bypasses the kernel’s normal page reference counting. The result is a controlled kernel write primitive. Together, these two CVEs cover each other’s exploitation gaps — much as CVE-2026-43284 and CVE-2026-43500 did in the Dirty Frag chain earlier this year.

CVE-2026-53266: netfilter ebtables SNAT Use-After-Free

The third CVE sits in the netfilter ebtables SNAT (Source Network Address Translation) module. This is the bridge-level packet filtering and NAT subsystem used in network virtualization, container networking, and traditional firewall setups. The bug is a use-after-free in the SNAT target’s translation table cleanup path — when a rule entry is deleted while a concurrent packet is being processed through it, the freed memory remains accessible to the packet processing code.

Because ebtables is used in Docker bridge networking, Kubernetes CNI implementations, and many hardware firewall appliances running Linux, this CVE is particularly relevant for container hosts and network appliances. The CVSS 7.8 score reflects that exploitation requires local access — but in containerized environments, that local access comes from any workload running on the host.

Check Your Exposure Immediately

Run these checks on every Linux server before applying the patch. They confirm which of the three attack surfaces are active on your system:

# CHECK 1: Current kernel version
uname -r

# CHECK 2: Is AF_ALG loaded (CVE-2025-39682 and CVE-2025-39964)?
lsmod | grep algif
grep CONFIG_CRYPTO_USER_API_HASH /boot/config-$(uname -r) 2>/dev/null
# CONFIG_CRYPTO_USER_API_HASH=y or =m = AF_ALG attack surface present

# CHECK 3: Is ebtables/netfilter SNAT active (CVE-2026-53266)?
lsmod | grep -E 'ebtables|ebt_snat|nf_nat'
ebtables -L 2>/dev/null | head -10
nft list ruleset 2>/dev/null | grep -i snat | head -5

# CHECK 4: Confirm CVE is in changelog after patching
# RHEL/AlmaLinux:
rpm -q --changelog kernel | grep -E 'CVE-2025-39682|CVE-2025-39964|CVE-2026-53266' | head -6
# Ubuntu/Debian:
apt-cache show linux-image-$(uname -r) 2>/dev/null | grep -E 'CVE-2025-39682|CVE-2026-53266'

Patch All Three CVEs: Commands by Distribution

All three CVEs are fixed in the same kernel update. A single kernel upgrade and reboot closes all of them simultaneously. Always verify the patched version is running after the reboot:

RHEL 9 / AlmaLinux 9 / Rocky 9

dnf clean metadata && dnf upgrade kernel -y
reboot
uname -r
rpm -q --changelog kernel | grep -E 'CVE-2025-39682|CVE-2025-39964|CVE-2026-53266' | head -3

RHEL 8 / AlmaLinux 8 / Rocky 8

dnf upgrade kernel -y
reboot
uname -r

Ubuntu 22.04 / 24.04 / 26.04 LTS

apt update && apt upgrade linux-image-generic -y
reboot
uname -r
# Track patch status:
# https://ubuntu.com/security/CVE-2025-39682
# https://ubuntu.com/security/CVE-2026-53266

Debian 12 / 13

apt update && apt full-upgrade -y
reboot
uname -r
# Track at: https://security-tracker.debian.org/tracker/CVE-2026-53266

Fedora 44 / 45

dnf upgrade --refresh -y && reboot
uname -r

Arch Linux

pacman -Syu && reboot
uname -r

The Full September 2026 Linux LPE Wave: Four More PoCs This Week

Beyond the three CISA KEV CVEs, four additional Linux local privilege escalation exploits with public proof-of-concept code dropped in the same week of September 18-21, 2026. While these have not yet been added to the KEV catalog, public PoC availability is typically the last step before active exploitation begins. Here is the complete September 2026 Linux security picture:

The scale of this wave reflects the structural shift described above. AI-assisted vulnerability research tools are systematically scanning old kernel code paths and converting memory bugs into working exploits faster than patch cycles can keep up. A single kernel upgrade this week closes the CISA KEV three plus most of the other CVEs simultaneously, since they are all fixed in the same kernel update.

Interim Mitigations While Waiting for a Patch Window

If a reboot requires a maintenance window, apply these no-reboot mitigations immediately to reduce your attack surface:

Restrict AF_ALG Access (CVE-2025-39682 and CVE-2025-39964)

# Check if AF_ALG modules are loaded
lsmod | grep algif

# If not needed, unload AF_ALG modules
rmmod algif_hash algif_skcipher algif_aead algif_rng 2>/dev/null

# Blacklist them to prevent future loads
cat > /etc/modprobe.d/blacklist-algif.conf << 'AEOF'
blacklist algif_hash
blacklist algif_skcipher
blacklist algif_aead
blacklist algif_rng
install algif_hash /bin/false
install algif_skcipher /bin/false
AEOF

# Verify
cat /etc/modprobe.d/blacklist-algif.conf

Restrict ebtables SNAT (CVE-2026-53266)

# Check if ebtables SNAT is in use
ebtables -L 2>/dev/null | grep SNAT
nft list ruleset 2>/dev/null | grep -i snat

# If SNAT rules are not in use, unload the module
rmmod ebt_snat 2>/dev/null && echo 'ebt_snat unloaded' || echo 'not loaded'

# Blacklist to prevent future loads
echo 'install ebt_snat /bin/false' >> /etc/modprobe.d/blacklist-algif.conf

# Note: if Docker or Kubernetes uses ebtables-based NAT, disabling this breaks networking
# In that case, prioritise the kernel patch over this mitigation

Patch Your Linux Fleet This Week

For environments managing multiple servers, verify each host's kernel version and patch systematically. Given the CISA KEV confirmation of active exploitation, prioritise production servers facing network traffic over internal-only systems:

# Audit entire fleet kernel versions via SSH
for HOST in server1 server2 server3 server4; do
  echo -n "$HOST kernel: "
  ssh root@$HOST 'uname -r' 2>/dev/null || echo 'UNREACHABLE'
done

# Batch upgrade -- RHEL/AlmaLinux fleet
for HOST in server1 server2 server3; do
  echo "=== Patching $HOST ==="
  ssh root@$HOST 'dnf upgrade kernel -y'
  echo "Reboot required on $HOST"
done

# Ubuntu/Debian fleet
for HOST in server1 server2 server3; do
  echo "=== Patching $HOST ==="
  ssh root@$HOST 'apt update -q && apt upgrade linux-image-generic -y'
done

# Verify all hosts after reboots
for HOST in server1 server2 server3; do
  echo -n "$HOST: "
  ssh root@$HOST 'uname -r && rpm -q --changelog kernel 2>/dev/null | grep CVE-2025-39682 | head -1'
done

The 2026 Linux Kernel LPE Pattern: What to Do Going Forward

September 2026 is not an anomaly. Since April 2026, the Linux kernel has seen Copy Fail, Dirty Frag, CIFSwitch, ssh-keysign-pwn, CVE-2026-23111, GhostLock, Bad Epoll, SCTPhantom, OVSwrap, and now the September CISA KEV batch. Each exploits a different subsystem. Each was found by an AI-assisted analysis tool or automated scanner. Because the discovery rate is now structurally faster than it has ever been, kernel patching frequency needs to match it.

The practical response is to treat kernel updates the same way you treat critical application patches — immediate, scheduled, and verified rather than deferred to a quarterly maintenance window. Our Linux server hardening checklist covers the standing configurations that reduce exposure between patches — disabling unprivileged user namespaces, enforcing SELinux or AppArmor, and keeping unnecessary kernel modules unloaded. Additionally, the ModuleJail kernel hardening tool automates the process of blacklisting unused modules across your entire fleet — including algif modules and ebtables components that most servers never need. The CISA KEV catalog is the authoritative source for confirmed active exploitations. The full September 2026 weekly briefing covering all active threats is at TechJack Solutions.

Conclusion

The CISA KEV Linux kernel September 2026 additions confirm that CVE-2025-39682, CVE-2025-39964, and CVE-2026-53266 are being actively exploited against real Linux systems right now. Start by running uname -r on every server and auditing which AF_ALG and ebtables modules are loaded. After that, blacklist algif modules and ebt_snat as an immediate no-reboot mitigation if your workloads do not require them. Then schedule the kernel update and reboot as soon as possible — a single upgrade closes all three CISA KEV CVEs simultaneously. After rebooting, verify the patched kernel version and confirm the CVE entries appear in the package changelog before removing interim mitigations. For Kubernetes worker nodes and Docker hosts specifically, also check that the ebtables SNAT mitigation does not break container networking before deploying fleet-wide. The CISA federal deadline was September 21. For production Linux infrastructure, your deadline is today.