The Cybersecurity and Infrastructure Security Agency has expanded its Known Exploited Vulnerabilities (KEV) catalog with three Linux kernel flaws, urging federal agencies to immediately patch them.
Tracked as CVE-2025-39682 (CVSS score of 9.8), the first of the bugs is a critical-severity issue impacting the kernel’s handling of zero-length records on the rx_list in the TLS receive path.
This is a corner case where the recvmsg() logic – each recvmsg() call processes either DATA or non-DATA records – breaks out of the processing loop when an initial zero-length record is pulled from rx_list.
When zero-copy decryption occurs, the kernel decrypts ciphertext into a user-space buffer. Because zero-copy is permitted only with DATA records, the vulnerable function assumes that no type change can occur after the zero-copy, but the logic can be broken using a zero-length record originating from rx_list.
A local attacker could exploit this improper check for unusual or exceptional conditions to cause a denial-of-service (DoS) condition or trigger memory disclosure.
The second vulnerability, CVE-2025-39964 (CVSS score of 7.8), is described as a race condition: issuing two writes to the same AF_ALG socket leads to data being interleaved in an unpredictable fashion.
An attacker could trigger the security defect to create inconsistencies in the socket’s internal state, leading to system crashes or corrupted cryptographic operation results, which could cause DoS conditions.
The third Linux kernel flaw newly added to CISA’s KEV list is CVE-2026-53266 (CVSS score of 8.8), an out-of-bounds write issue in the bridge Netfilter ebtables Source Network Address Translation (SNAT) target.
Under certain conditions, an Address Resolution Protocol (ARP) sender hardware address is written directly into a nonlinear socket-buffer fragment, causing memory corruption.
An attacker can trigger the unsafe write with a crafted packet containing an ARP payload, leading to unauthorized memory modification outside the intended packet buffer.
CISA has not shared details on the exploitation of the three vulnerabilities, but told federal agencies they should patch all three within three days.
Related: Microsoft Patches 18 Vulnerabilities in AI, Cloud Products
Related: Critical Orkes Conductor Vulnerability Exploited in Attacks
Related: Check Point, Kaspersky, Tanium Patch Product Vulnerabilities
Related: ISC Patches 14 Vulnerabilities in BIND 9 Security Update
