Linux Kernel: Five Exploited Root Bugs Added to CISA KEV

What to do

1. Run uname -r on every Linux host and compare it with your distribution's fixed kernel for each CVE.
2. Install the current kernel and reboot, starting with container hosts, Kubernetes nodes, CI runners and multi-user servers.
3. If a reboot must wait, block the tls module where kTLS is unused and remove ebtables SNAT rules that rewrite ARP addresses (Red Hat's interim mitigations).
4. For untrusted containers, deny AF_ALG sockets with seccomp, and where rootless containers are not needed, set user.max_user_namespaces=0 (Red Hat's workaround for CVE-2026-53362).
5. Ask appliance and embedded-Linux vendors for fixed firmware; the CVE records link Siemens advisories for three of these bugs.

How to check if you are affected or compromised

• Compare the running kernel (uname -r) with the installed package; a fixed package without a reboot is still exposed.
• Check preconditions: lsmod | grep -E 'tls|algif|ebt', sudo ebtables -t nat -L for ARP SNAT rules, and sysctl user.max_user_namespaces.
• Hunt for unexpected writes to /proc/sys/kernel/core_pattern (the published Fraggap, AF_ALG and kTLS exploits all abuse it) and root processes descended from unprivileged users or containers.
• Review journalctl -k or dmesg for oopses, use-after-free or skb warnings in tls, af_alg, ebt_snat or ip6_append_data, and preserve evidence before rebooting suspect hosts.

What happened#

Between August 26 and September 18, 2026, CISA added five Linux kernel bugs to its Known Exploited Vulnerabilities catalog. All five let a local user corrupt kernel memory and, in practice, become root. All had upstream fixes before they were listed. CISA has not said who is exploiting them or against whom, and every entry carries its forensic-triage requirement. The Hacker News reports that Red Hat updated its advisories for the September batch on September 19 to acknowledge exploitation and "known public exploits."

• CVE-2025-39682 (kTLS): a zero-length record on the kernel TLS receive list leads to a use-after-free. The CVE record and NVD score it 9.8 as network-reachable. Red Hat scores it 7.0 and says it is remotely triggerable "only when kernel TLS ... is in use." A kernelCTF exploit published in February 2026 sets up its own loopback kTLS connection.
• CVE-2025-39964 (AF_ALG): two threads writing to one crypto socket corrupt its state. The code dates to Linux 2.6.38. Its kernelCTF write-up, added August 11, 2026, needs no capabilities and no user namespaces. Cyber Security News credits STAR Labs and reports a Docker escape in a proof-of-concept setup.
• CVE-2026-53266 (ebtables SNAT): an ARP address rewrite copies a MAC address straight into a splice-imported file page. The CNA scores it 8.8 and notes that the required CAP_NET_ADMIN can come from a user namespace.
• CVE-2026-53362 ("Fraggap"): a 15-byte out-of-bounds write in the UDPv6 send path. It was disclosed on July 20 with a public exploit used in kernelCTF. Red Hat's RHSB-2026-009 warns of container escape and SELinux bypass.
• CVE-2022-0995 (watch_queue): an out-of-bounds write in the notification filter, fixed in March 2022. The CVE record links two public exploits on Packet Storm. CISA added it in a batch of six mostly older bugs.

None of these is Copy Fail (CVE-2026-31431), but two are close relatives. The AF_ALG race sits in the same socket family, and the CVE record says skcipher sockets reach it too, so blocking only algif_aead does not help. The ebtables bug, like Copy Fail, ends with the kernel writing into a file's cached page.

Who is affected#

Taking the highest fix per stable line from the CVE records, 5.10.259, 5.15.210, 6.1.177, 6.6.144, 6.12.95, 6.18.38 and 7.1.3 cover every bug here that applies to that line. Distribution status differs:

• RHEL: Red Hat's CVE data lists Fraggap as RHEL 10 only and the kTLS bug as not affecting RHEL 8. No shipped RHEL kernel was affected by CVE-2022-0995. The AF_ALG and ebtables bugs reach RHEL 7 ELS through 10. Kernels from September 22-24, 2026 cover all five.
• Debian: the security tracker lists bookworm fixed in 6.1.177-1 and trixie in 6.12.95-1. Bullseye is fixed in 5.10.259-1 and not affected by the kTLS or IPv6 bugs.
• Ubuntu: 24.04 needs 6.8.0-147.147 for Fraggap, and several 24.04 HWE and OEM kernels were still listed as vulnerable. For the ebtables bug, 22.04 is fixed in 5.15.0-198.208 and 20.04 is still listed as vulnerable.

Do you really need to act?#

Yes, but on a "this week" clock, not "drop everything." Every bug needs code already running on the box. That makes them second-stage tools, used after a phished account, a compromised web app or a malicious CI job. Where tenants share a kernel, the AF_ALG bug needs no special configuration. Fraggap needs IPv6, and Red Hat adds the ability to create network namespaces, which RHEL 10 grants by default. Both have public root exploits. The ebtables bug also needs namespace privileges. Red Hat calls its exposure limited to systems with specific bridge rules. On single-user servers and laptops, risk is lower. If you have installed and booted a kernel from late September 2026 or later, you are done.

What to do now#

1. Inventory kernels: uname -r everywhere, then rpm -q kernel or apt list --installed 'linux-image*'.
2. Update and reboot: dnf update kernel or apt-get install --only-upgrade linux-image-generic, then reboot into the new kernel.
3. If the reboot must wait, follow Red Hat's interim mitigations: blacklist tls where kTLS is unused, and remove ebtables SNAT rules that rewrite ARP addresses.
4. Where rootless containers are not needed, apply RHSB-2026-009's workaround, sysctl -w user.max_user_namespaces=0. Deny socket(AF_ALG, ...) in seccomp profiles for untrusted workloads.
5. Ask appliance vendors for fixed firmware. The CVE records link Siemens advisories for three of these bugs.

How to tell if you were hit#

The Cloud Security Alliance notes that CISA has disclosed no details of the intrusions, and we found no published indicators as of Oct 21, 2026. Look for unexpected writes to /proc/sys/kernel/core_pattern, which the public Fraggap, AF_ALG and kTLS exploits all abuse. Also look for root processes descended from unprivileged users or containers, and kernel oopses that mention tls, af_alg, ebt_snat or ip6_append_data in journalctl -k. Capture memory and logs before rebooting a suspect host.

Timeline#

• Mar 11, 2022 — watch_queue fix for CVE-2022-0995 committed upstream.
• Sep 5, 2025 — CVE-2025-39682 (kTLS) published with stable fixes.
• Oct 13, 2025 — CVE-2025-39964 (AF_ALG) published.
• Jun 25, 2026 — CVE-2026-53266 (ebtables) published.
• Jul 20, 2026 — Fraggap (CVE-2026-53362) write-up and exploit published.
• Aug 26, 2026 — CISA adds CVE-2022-0995 to KEV. CVE-2026-53362 follows on Aug 27.
• Sep 18, 2026 — CISA adds CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266, with a federal deadline of Sep 21.

Vulnerability records

• CVE-2025-39682 · KEV 2026-09-18 · In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process…
• CVE-2025-39964 · KEV 2026-09-18 · In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the…
• CVE-2026-53266 · KEV 2026-09-18 · In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the…
• CVE-2026-53362 · KEV 2026-08-27 · In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the…
• CVE-2022-0995 · KEV 2026-08-26 · An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CVE record — CVE-2025-39682 cve.org
2. CVE record — CVE-2025-39964 cve.org
3. CVE record — CVE-2026-53266 cve.org
4. CVE record — CVE-2026-53362 cve.org
5. CVE record — CVE-2022-0995 cve.org
6. CISA — Known Exploited Vulnerabilities: CVE-2025-39682 cisa.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2025-39964 cisa.gov
8. CISA — Known Exploited Vulnerabilities: CVE-2026-53266 cisa.gov
9. CISA — Known Exploited Vulnerabilities: CVE-2026-53362 cisa.gov
10. CISA — Known Exploited Vulnerabilities: CVE-2022-0995 cisa.gov
11. CISA — CISA Adds Six Known Exploited Vulnerabilities to Catalog (Aug 26, 2026) cisa.gov
12. Linux kernel — watch_queue: Fix filter limit check (CVE-2022-0995 fix) git.kernel.org
13. Red Hat — RHSB-2026-009 IPv6 Fragmentation Container Escape (CVE-2026-53362) access.redhat.com
14. Red Hat — CVE-2026-53266 access.redhat.com
15. Red Hat — CVE-2025-39682 access.redhat.com
16. oss-security — CVE-2026-53362, CVE-2026-53366: OOB write in UDP MSG_SPLICE_PAGES handling openwall.com
17. qwerty — Frag Gap write-up and exploit (CVE-2026-53362) blog.qwerty.or.kr
18. Google security-research — kernelCTF CVE-2025-39682 exploit github.com
19. Google security-research — kernelCTF CVE-2025-39964 exploit github.com
20. Debian security tracker — CVE-2026-53362 security-tracker.debian.org
21. Ubuntu — CVE-2026-53266 ubuntu.com
22. Ubuntu — CVE-2026-53362 ubuntu.com
23. Cloud Security Alliance — CISA Flags Three Actively Exploited Linux Kernel Flaws labs.cloudsecurityalliance.org
24. Cyber Security News — 14-year-old Linux kernel flaw (CVE-2025-39964) cybersecuritynews.com

Coverage and analysis

1. The Hacker News — CISA Flags Three Linux Kernel Flaws thehackernews.com