CISA Adds 3 Exploited Linux Kernel Flaws to KEV Catalog
CISA: Three Linux Kernel Flaws Actively Exploited in the Wild
CVE Identifiers
MITRE ATT&CK Techniques
Full Report
Executive Summary
On September 19, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a directive by adding three vulnerabilities affecting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog. The inclusion confirms that these flaws are being actively exploited in the wild. The vulnerabilities range in severity and could allow a local attacker to cause a denial-of-service (DoS), disclose sensitive memory contents, or escalate privileges on an affected system. Due to the active exploitation, CISA has set a deadline of September 21, 2026, for Federal Civilian Executive Branch (FCEB) agencies to remediate these vulnerabilities, signaling a high level of urgency for all organizations running affected Linux systems.
Vulnerability Details
The three vulnerabilities added to the KEV catalog are:
-
- CVSS Score: 9.8 (Critical)
- Description: An improper check in the Transport Layer Security (TLS) receive path. An authenticated local user could exploit this flaw to trigger memory disclosure or a system-wide denial-of-service condition.
-
- CVSS Score: 8.8 (High)
- Description: An out-of-bounds write vulnerability in the ebtables SNAT ARP rewrite path. A local attacker with the ability to manipulate ebtables rules could leverage this to cause a DoS, achieve local privilege escalation, or trigger other unintended system behaviors.
-
- CVSS Score: 7.8 (High)
- Description: A race condition within the AF_ALG socket interface, which is used for kernel-based cryptography. A local attacker could exploit this race condition to crash the system, corrupt cryptographic operations, or cause data integrity issues.
Affected Systems
The vulnerabilities reside within the Linux kernel, affecting a wide range of Linux distributions. Organizations should consult advisories from their specific Linux distribution vendors (e.g., Red Hat, Ubuntu, Debian, SUSE) to determine if their systems are affected and to obtain the correct patches. Red Hat has already updated its advisories to reflect the active exploitation status and urge customers to patch with high priority.
Exploitation Status
CISA has confirmed evidence of active exploitation for all three vulnerabilities. While specific details about the threat actors or campaigns leveraging these exploits have not been publicly released, the KEV designation indicates a clear and present danger. The exploits are likely being used as part of attack chains, where an attacker who has already gained initial low-privilege access to a Linux system can use these flaws to escalate to root-level privileges, fully compromising the host.
Impact Assessment
Exploitation of these vulnerabilities can lead to severe consequences. Local privilege escalation is a common step for attackers to establish complete control over a compromised system, disable security measures, install persistent backdoors, and pivot to other systems on the network. Given the widespread use of Linux in servers, cloud infrastructure, and embedded devices, the potential impact is vast, affecting organizations across all sectors. The DoS and data integrity risks also pose a threat to the availability and reliability of critical services.
Cyber Observables — Hunting Hints
The following patterns may help identify vulnerable or compromised systems:
dmesg, /var/log/kern.log)uname -rrootDetection Methods
- Vulnerability Scanning: Use authenticated vulnerability scanners to check the kernel versions of Linux systems across the environment and compare them against patched versions.
- Log Analysis: Monitor kernel and system logs for crashes (
SIGSEGV,Oops), especially those related to the networking or crypto subsystems, which could indicate exploitation of these CVEs. This aligns with Log Analysis. - Endpoint Detection and Response (EDR): EDR agents on Linux can detect suspicious process behavior, such as a low-privilege process spawning a root shell, which is a common indicator of successful privilege escalation (
T1068 - Exploitation for Privilege Escalation).
Remediation Steps
- Prioritize Patching: Immediately identify all Linux systems in your environment. Prioritize patching based on asset criticality, starting with internet-facing servers and critical infrastructure.
- Apply Updates: Apply the security updates provided by your Linux distribution vendor as soon as possible. Follow the BOD 26-04 deadline of September 21, 2026, as a guide for urgency.
- Verify Patches: After deployment, verify that the patches have been successfully applied and the systems have been rebooted into the new kernel if required.
- Compensating Controls: If patching cannot be immediately applied, limit interactive login access to trusted administrators, enforce strong access controls, and increase monitoring on vulnerable systems to detect exploitation attempts.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
The primary mitigation is to apply the security updates provided by the respective Linux distribution vendors to patch the kernel vulnerabilities.
Enable and monitor system and kernel logs to detect anomalous behavior, crashes, or other indicators of exploitation attempts.
Operating System Configuration
Harden operating system configurations, for example by using security-enhancing kernel modules like SELinux or AppArmor to restrict process capabilities and limit the impact of a successful exploit.
D3FEND Defensive Countermeasures
The most critical and immediate action is to apply the patches released by Linux distribution vendors. Given that these are kernel vulnerabilities, this will typically require a system reboot. Organizations must have a robust patch management process that can quickly identify all vulnerable Linux systems, deploy the updated kernel packages, and manage the required reboots to activate the new kernel. For critical systems, this should be done within the window specified by CISA (by Sept 21). This directly remediates the root cause of the vulnerabilities and is the only way to be fully protected from these specific exploits.
While patching is in progress, or as a compensating control, deploy EDR or host-based intrusion detection systems to perform process analysis. Specifically, monitor for signs of privilege escalation. Create detection rules that alert when a process running under a low-privilege user account (e.g., www-data, nobody) spawns a child process that has root privileges (UID 0). This is a very strong indicator of successful exploitation of a local privilege escalation vulnerability like CVE-2026-53266. This provides a crucial detection layer to catch exploitation on systems that are not yet patched.
For high-security environments or systems that cannot be immediately patched, advanced hardening can be applied using system call filtering. Tools like seccomp-bpf in Linux can be used to restrict the system calls that a process is allowed to make. By creating a strict profile for applications (e.g., a web server), you can prevent them from making the specific, obscure syscalls needed to trigger these kernel vulnerabilities. This is a complex but powerful hardening technique that can break exploits by denying them access to the vulnerable kernel code paths. This is particularly relevant for containerized environments where application behavior is well-defined.
Timeline of Events
CISA adds three Linux kernel vulnerabilities to its KEV catalog.
Red Hat updates its advisories to acknowledge active exploitation.
Deadline for FCEB agencies to apply patches for the vulnerabilities.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.