Three Linux kernel primitives land on KEV in one week

Between September 18 and 22, 2026, CISA added CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 to its Known Exploited Vulnerabilities catalog with a three day patch deadline under BOD 26-04, and Red Hat asserts active exploitation for each. The KEV entries do not usually stack three unrelated kernel primitives together in one week; this one did. The three share no code path: kTLS lives in the socket layer, ebtables SNAT lives in bridge netfilter, and AF_ALG is the userspace hook into the kernel crypto API. What they share is a shape: a fast path that trusts something the caller can actually violate.

CVE-2025-39682: a zero-length kTLS record slips a type check

Kernel TLS handles record framing inside the kernel so a userspace program can call sendmsg and recvmsg on a plain TCP socket and get encryption for free. One receive call is meant to return either contiguous data records or a single non-data record, never both, because zero copy is only allowed for DATA records.

The bug is a missing per-call type check on records dequeued from rx_list, the queue that holds decrypted records between calls. When the first record dequeued is zero length, the receive loop breaks out before the type is registered. A subsequent record with a different type then rides the same call, and the zero copy path processes it under DATA assumptions that no longer hold. Red Hat rates this CVSS 9.8 because the code path is reachable remotely on any TCP socket with kTLS attached, which is the default for anything terminating TLS in kernel space for throughput. Fix landed in 6.1.149, 6.6.103, 6.12.44, and 6.16.4; the patch initializes the per call content type and bails out on a type change after DATA.

CVE-2026-53266: an ARP rewrite writes into a page it should not touch

If you have ever configured a Linux bridge with an ebtables rule that rewrites the sender hardware address on ARP frames, you have touched ebt_snat. The rewrite is a small piece of code: call skb_store_bits to overwrite the six byte ARP SHA field. The bug is what the code does when the skb backing that write is nonlinear.

Linux sockets can splice pages from files into an skb using sendfile and splice. When one of those pages rides through the bridge as a fragment of a nonlinear skb, the ARP SHA offset can land inside a splice imported page instead of a writable copy. skb_store_bits does not fault; it writes through to the underlying file page, and that page belongs to whatever the file cache thinks it belongs to. The write can land on an unrelated kernel object, on a page cache entry, or on a userspace mapping. Kimmo Suominen published an inferred privilege escalation chain by analogy with the Dirty Pipe class of page cache overwrite bugs, marked as reasoned rather than demonstrated end to end. CVSS 8.8. Fixed in 5.10.259, 6.1.176, and 6.12.94.

CVE-2025-39964: two writers, one crypto socket, a proven container escape

AF_ALG is the socket family that gives userspace access to the kernel crypto API. A program opens an AF_ALG socket, binds it to a cipher, then feeds data through sendmsg. The datapath allowed two writers on the same socket concurrently. Payloads interleave, the per socket context lands in an inconsistent state, and the crypto op runs against a buffer nobody in the code expected.

STAR Labs found this one and demonstrated it at Google's kernelCTF as a privilege escalation and container escape, which is the proof of exploit primitive you rarely get for a plain race in the kernel. The bug sat in tree for fourteen years. The patch adds exclusive write ownership so only one sendmsg can hold the socket at a time. Red Hat rates it CVSS 7.8. Federal civilian agencies had until September 21 to patch under BOD 26-04, which also requires forensic triage on assets that could already have been touched. Independent reporting covers the STAR Labs kernelCTF context.

The severity number sorts your patch queue wrong

Take the raw scores: 9.8, 8.8, 7.8. A queue sorted by CVSS puts kTLS at the top and tells you to patch the AF_ALG box last. In a fleet where the kTLS boxes are a locked down loadbalancer estate on internal VLANs, and the AF_ALG boxes include Kubernetes worker nodes with untrusted tenant containers, that order is backwards. AF_ALG has a demonstrated container escape primitive from a public kernelCTF submission; kTLS has an "improper condition check" that public sources describe as memory disclosure and DoS with no exploit chain in view. Sorting on the base metric routes your on call to patch the least reachable primitive first.

How TRIS scores this batch on a real Linux estate

TRIS is the Threat and Risk Intelligence Scoring engine inside CVEasy AI. It walks four layers against your inventory for each CVE and produces a different rank than the CVSS list.

Exploitation evidence. All three are on CISA KEV with active exploitation asserted by Red Hat. AF_ALG has a documented kernelCTF submission from STAR Labs; the other two carry no public PoC. TRIS keeps that delta rather than collapsing a proven public PoC and an asserted in-the-wild exploitation into one number.

Reachability from the exposure surface. kTLS is only reachable through a TCP socket with TLS offload attached; on a Kubernetes worker with no kTLS-enabled listener the primitive does not exist. ebt_snat requires bridge netfilter loaded and an ARP SHA rewrite rule installed. AF_ALG is reachable from any userspace process that can open an AF_ALG socket, which in a container without an explicit seccomp filter includes every workload.

Blast radius given a foothold. All three end at kernel state corruption. AF_ALG has a demonstrated privesc plus container escape at kernelCTF, ebt_snat has a plausible page cache overwrite chain, kTLS has memory disclosure and DoS on the public sources today.

Fix availability against the running kernel. On 6.1 LTS you need 6.1.176 for ebt_snat, 6.1.149 for kTLS, plus the AF_ALG backport. Kernels between 6.1.149 and 6.1.175 close kTLS and AF_ALG but leave ebt_snat open. TRIS reads the installed kernel off the box and marks partial fixes accordingly.

The same three CVEs land at top band ACT on an exposed multi-tenant Kubernetes node, and one band lower on an internal appliance that runs neither AF_ALG nor bridge netfilter. A CVSS-first queue cannot produce that split.

What to patch, what to hunt for, what to rotate

Patch to the stable line above the highest of the three fix versions. For 6.1 LTS that means 6.1.176 or later; for 6.6, 6.6.103; for 6.12, 6.12.94; for 6.16, 6.16.4. Red Hat, Ubuntu, Debian, and SUSE backports are shipping now. On boxes you cannot patch in the window, mitigate: unload ebtable_nat and remove ARP SHA rewrite rules from bridges; block AF_ALG socket creation with a seccomp filter on containers that do not need kernel crypto; disable kTLS offload on sockets that do not require it.

Hunt before you close the ticket. BOD 26-04 requires forensic triage on top of the patch. For kTLS, walk your TLS terminators for unexpected socket resets and unusual record type transitions. For ebt_snat, audit any host with bridge netfilter loaded for ARP rewrite rules and correlate against splice or sendfile activity on the same box. For AF_ALG, look for container workloads that opened AF_ALG sockets outside their normal profile.

How CVEasy AI surfaces this batch

CVEasy AI is the number one local-first CTEM (Continuous Threat Exposure Management) platform. When Red Hat and CISA publish a batch like this one, the ingest picks up all three CVEs, the fixed stable versions, and the KEV status, and TRIS runs the four layer scoring against the inventory already on your hardware. A Kubernetes node on a 6.1 kernel below 6.1.176 with untrusted tenant containers gets a top band ACT with a workflow that names the kernel target, the seccomp filter for AF_ALG, and the ebtables rule to remove. A hardened internal loadbalancer running kTLS gets a lower band with a patch-when-ready recommendation and a hunt query for kTLS socket resets. The inventory stays on your hardware; the answer to which box you patch first this week does not travel through a cloud SaaS.

Sources: Cyber Security News, SecurityOnline, Ton Does Linux, SentinelOne, Brinztech