Three Linux Kernel Bugs Hit KEV: AF_ALG, ebtables SNAT and Kernel TLS

On 18 September 2026 CISA added three Linux kernel vulnerabilities to the Known Exploited Vulnerabilities catalog in two alerts: CVE-2025-39964 in the AF_ALG crypto socket interface, CVE-2026-53266 in the ebtables SNAT target, and CVE-2025-39682 in the kernel TLS receive path. All three carry a federal due date of 21 September, and CISA marked all three for its forensic triage requirements.

Two of the three are a year old. CVE-2025-39682 was published in September 2025 and CVE-2025-39964 in October 2025. CISA did not publish details of who exploited them or how, so the best you can do is close them fast and check which ones your hosts can reach at all.

What's affected

All three fixes are small, specific commits in the stable kernel trees. NVD lists these first fixed versions per stable branch.

CVE-2025-39964, AF_ALG concurrent writes. The fix commit, crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg, explains that two writes to the same AF_ALG socket could interleave data unpredictably and leave the socket's internal state inconsistent. The kernel CNA scores it 7.8 as a local bug; NVD's own score is 5.5. Affected from 2.6.38. Fixed in 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9.

CVE-2026-53266, ebtables SNAT out-of-bounds write. When the ebtables SNAT target rewrites the ARP sender hardware address, it writes with skb_store_bits() without first making that range writable. If the bytes sit in a socket buffer fragment backed by a page imported with splice from a file, the new MAC address is copied straight into that file page. The kernel CNA scores it 8.8 with a scope change. Fixed in 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36 and 7.0.13. NVD lists the affected 5.4 range with no fixed version, and CISA notes the affected products could be end of life.

CVE-2025-39682, kernel TLS zero-length record. The fix, tls: fix handling of zero-length records on the rx_list, covers a corner case where a zero-length record pulled from the receive list skips the normal record-type handling, so later records are processed under the wrong zero-copy and queuing assumptions. NVD and the kernel CNA both score it 9.8 with a network attack vector. Affected from 6.0. Fixed in 6.1.149, 6.6.103, 6.12.44 and 6.16.4.

Most people don't run upstream stable kernels directly. Your distribution backports these commits into its own package versions, so check its security tracker for the matching package rather than comparing version strings alone.

How to check if you're exposed

Start with the running kernel, not the installed package. A host that installed a fixed kernel but never rebooted is still exposed.

uname -r

Then check which of the three code paths are loaded or loadable on the host. Each bug lives in a feature that many servers never use:

# AF_ALG userspace crypto API
lsmod | grep -E '^(af_alg|algif_)'

# ebtables and the SNAT target
lsmod | grep -E '^(ebtables|ebt_snat|ebtable_)'

# kernel TLS
lsmod | grep -E '^tls '

# are any ebtables rules actually configured?
sudo ebtables -t nat -L 2>/dev/null | grep -i snat

A module that is not loaded can often still be auto-loaded on demand, so an empty lsmod result lowers urgency but doesn't remove the bug. Use it to rank hosts, not to skip them.

The hosts to patch first are ones where an untrusted local user or workload runs next to something valuable: shared build runners, multi-tenant container hosts, hypervisors and bridges using ebtables, and anything terminating kernel TLS.

What to do now

1. Install your distribution's kernel update that includes all three fixes, and reboot. Confirm with uname -r afterwards.
2. If you run livepatching, check that your vendor's livepatch actually covers each of the three CVEs before you count those hosts as done.
3. Where a reboot has to wait, block auto-loading of modules the host doesn't need. For example, in /etc/modprobe.d/kev-2026-09.conf:

install algif_aead /bin/false
install algif_skcipher /bin/false
install algif_hash /bin/false
install ebt_snat /bin/false

Test this first. Some disk encryption and crypto tooling uses AF_ALG, and kernel TLS may be in use by web servers or proxies configured for it.

4. Find hosts on a 5.4 kernel. NVD lists no fixed version for CVE-2026-53266 on that branch, so they need a vendor-backported fix or a move to a supported kernel.
5. Include container hosts and CI runners in the rollout. Containers share the host kernel, so a patched image does nothing for these bugs.

Why it matters

Kernel bugs are rarely the first step in an intrusion. They are the step after: an attacker with a foothold as an unprivileged user, or inside a container, uses one to become root on the host. That is why multi-tenant infrastructure carries the most risk here.

The age of two of these CVEs matters too. Fixes for both were in stable kernels in autumn 2025. Fleets that still carry them a year later are fleets where kernel updates install but never get rebooted into. Track the running kernel, not the package.

Try it yourself

Run uname -r and the lsmod checks above across ten of your servers, and record two columns: running kernel version, and which of the three modules is loaded. You will likely find that each bug applies to a different subset of hosts. That is the same idea as reachability analysis for application dependencies, which asks whether your code ever calls the vulnerable function. See it applied here:

Click through it at your own pace, or open it full screen.

Quick check

Sources

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (18 September 2026)
• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (18 September 2026)
• CISA Known Exploited Vulnerabilities Catalog
• NVD: CVE-2025-39964
• NVD: CVE-2026-53266
• NVD: CVE-2025-39682
• Linux stable fix for CVE-2025-39964
• Linux stable fix for CVE-2026-53266
• Linux stable fix for CVE-2025-39682