Critical
Linux kernel, CVE-2025-39682, CISA KEV, privilege escalation, local root, exploited, ebtables, AF_ALG
Linux Kernel CVE-2025-39682: 3 Flaws Exploited (CISA KEV)
Linux kernel CVE-2025-39682 and two more are in CISA KEV, exploited in the wild, plus 4 public local-root exploits. Which kernel flaws to patch now.
Linux kernel CVE-2025-39682 is one of three kernel flaws CISA added to its Known Exploited Vulnerabilities catalog on September 18, 2026 after confirmed in-the-wild attacks, with a federal patch deadline of September 21. The trio spans the TLS receive path (CVE-2025-39682, CVSS 9.8), ebtables SNAT ARP rewriting (CVE-2026-53266, CVSS 8.8), and the AF_ALG crypto socket (CVE-2025-39964, CVSS 7.8). Update to a patched kernel and reboot now.
Red Hat acknowledged active exploitation on September 19, 2026, and the same week researcher Asim Manizada released public proof-of-concept exploits for four separate Linux kernel flaws that grant local root, CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), and CVE-2026-74469 (DiagSpill). The two events together mean the Linux kernel is having a bad month: three bugs proven exploited and four more with working exploits now circulating. The Hacker News reported both.
The KEV trio matters because it is evidence, not prediction. CVE-2025-39682 is an improper-exception-handling flaw (CWE-754) in the kernel's TLS receive path rated CVSS 9.8; CVE-2026-53266 is an out-of-bounds write (CWE-787) in ebtables SNAT ARP rewriting at 8.8; and CVE-2025-39964 is a race condition (CWE-362) in the AF_ALG crypto socket interface at 7.8. CISA's inclusion means each has been observed in real attacks, and BOD 26-04 gives federal agencies until September 21 to remediate, a three-day window that signals urgency for everyone, not just government.
Which Linux kernel CVEs are being exploited, and which have public exploits?
Two distinct groups are in play this week. The first is the CISA KEV set, confirmed exploited in the wild. The second is a batch of freshly published local-root exploits that are not yet listed in KEV but are trivially available to attackers now.
CVE | Area | CVSS | Status |
|---|---|---|---|
CVE-2025-39682 | TLS receive path (CWE-754) | 9.8 | In CISA KEV (2026-09-18), exploited |
CVE-2026-53266 | ebtables SNAT ARP (CWE-787) | 8.8 | In CISA KEV (2026-09-18), exploited |
CVE-2025-39964 | AF_ALG socket (CWE-362) | 7.8 | In CISA KEV (2026-09-18), exploited |
CVE-2026-80844 (DirtyAH6) | Local root | Public PoC | Exploit released, not yet KEV |
CVE-2026-81000 (TUNderflow) | Local root | Public PoC | Exploit released, not yet KEV |
CVE-2026-68121 (PPPoEject) | Local root | Public PoC | Exploit released, not yet KEV |
CVE-2026-74469 (DiagSpill) | Local root | Public PoC | Exploit released, not yet KEV |
Why do the local-root exploits matter if they are not in KEV yet?
Because a public, working exploit is a stronger signal than any score for kernel bugs. KEV and EPSS both lag local-privilege-escalation flaws: the exploitation data the models key on arrives after the code is already circulating. A released proof-of-concept that hands an unprivileged user root on a shared or multi-tenant host is exploitable today, whether or not a catalog has caught up. For DirtyAH6, TUNderflow, PPPoEject, and DiagSpill, treat "exploit exists" as the trigger to patch, not the KEV listing you are still waiting for.
Our read
This week is a compact demonstration of why point-in-time signals mislead on kernel risk. Three of these flaws are in KEV because attackers used them; four more have public exploits but no KEV entry, and a severity-only patch queue would rank the four as "later" precisely when they are most dangerous. Our review of 2025's actively exploited vulnerabilities found the median gap between disclosure and exploitation was just 26 days, and kernel local-privesc bugs routinely beat that once code circulates. The defensible posture is continuous verification: patch to a fixed kernel and reboot, then confirm which hosts actually rebooted, because a running unpatched kernel is still exploitable no matter what the package manager reports. Prioritize multi-user, container, and CI hosts, where a low-privilege foothold turning into root is the whole attack.
Reporting by The Hacker News; CVSS, CWE, and KEV dates per the NVD records and the CISA Known Exploited Vulnerabilities catalog; public exploits credited to Asim Manizada. Sources linked above.
Frequently asked questions
What is CVE-2025-39682?
It is a CVSS 9.8 Linux kernel flaw in the TLS receive path (CWE-754, improper exception handling), added to CISA KEV on September 18, 2026 after confirmed in-the-wild exploitation, with a federal remediation deadline of September 21.
Which Linux kernel vulnerabilities did CISA add to KEV?
Three: CVE-2025-39682 (TLS receive path, 9.8), CVE-2026-53266 (ebtables SNAT ARP rewriting, 8.8), and CVE-2025-39964 (AF_ALG socket race condition, 7.8), all added September 18, 2026.
Are there public exploits for Linux kernel local root right now?
Yes. Researcher Asim Manizada released proof-of-concept exploits for four kernel flaws, CVE-2026-80844 (DirtyAH6), CVE-2026-81000 (TUNderflow), CVE-2026-68121 (PPPoEject), and CVE-2026-74469 (DiagSpill), each enabling local privilege escalation to root.
How do I fix these Linux kernel vulnerabilities?
Update to your distribution's patched kernel and reboot, since a running unpatched kernel stays vulnerable. Prioritize multi-user, container, and CI hosts, and confirm the reboot actually happened across the fleet.