---
title: "Linux Kernel: Five Exploited Root Bugs Added to CISA KEV"
url: https://erroneo.us/security/briefs/linux-kernel-five-exploited-lpe-bugs-kev/
description: "CISA lists five Linux kernel privilege-escalation bugs (kTLS, AF_ALG, ebtables, IPv6, watch_queue) as exploited. Fixes exist; patch and reboot this week."
type: security-brief
section: "Security Digest"
date_published: 2026-09-18
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Patch this week"
cves: ["CVE-2025-39682", "CVE-2025-39964", "CVE-2026-53266", "CVE-2026-53362", "CVE-2022-0995"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Linux Kernel: Five Exploited Root Bugs Added to CISA KEV

**Verdict: Patch this week.** Five local root bugs, all with fixes and most with public exploits, are now confirmed exploited; get every Linux host onto a current kernel and reboot this week, container hosts, CI runners and shared servers first.

- **Who must act:** Anyone running Linux kernels older than their distribution's July to September 2026 security updates, most urgently where containers, CI jobs or untrusted users share a kernel.
- **Who can relax:** Hosts already booted into current distribution kernels (for example RHEL kernels from Sep 22-24, 2026, Debian 12 6.1.177-1+, Ubuntu 24.04 6.8.0-147.147+); single-user machines face local-only risk.
- **Affected:** CVE-2025-39682 (kTLS): Linux 6.0 before 6.1.149, 6.6.103, 6.12.44, 6.16.4; CVE-2025-39964 (AF_ALG): Linux 2.6.38 before 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49, 6.16.9; CVE-2026-53266 (ebtables SNAT): Linux 5.10 (plus some 5.4/5.8/5.9 stable builds) before 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13; CVE-2026-53362 (IPv6 Fraggap): Linux 6.x before 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3; CVE-2022-0995 (watch_queue): Linux 5.8 before 5.10.106, 5.15.29 and 5.17
- **Fixed:** Upstream stable 5.10.259, 5.15.210, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3 or later (each covers every bug in this group that affects its line); RHEL 10 kernel 6.12.0-211.59.1.el10_2 (RHSA-2026:71233) or later; RHEL 9 kernel 5.14.0-687.50.1.el9_8 (RHSA-2026:70459) or later; RHEL 8 kernel 4.18.0-553.166.1.el8_10 (RHSA-2026:70402) or later; Debian 11 linux 5.10.259-1, Debian 12 linux 6.1.177-1, Debian 13 linux 6.12.95-1 or later; Ubuntu 22.04 linux 5.15.0-198.208, Ubuntu 24.04 linux 6.8.0-147.147, Ubuntu 26.04 linux 7.0.0-31.31 or later
- **CVEs:** CVE-2025-39682, CVE-2025-39964, CVE-2026-53266, CVE-2026-53362, CVE-2022-0995
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run uname -r on every Linux host and compare it with your distribution's fixed kernel for each CVE.
2. Install the current kernel and reboot, starting with container hosts, Kubernetes nodes, CI runners and multi-user servers.
3. If a reboot must wait, block the tls module where kTLS is unused and remove ebtables SNAT rules that rewrite ARP addresses (Red Hat's interim mitigations).
4. For untrusted containers, deny AF_ALG sockets with seccomp, and where rootless containers are not needed, set user.max_user_namespaces=0 (Red Hat's workaround for CVE-2026-53362).
5. Ask appliance and embedded-Linux vendors for fixed firmware; the CVE records link Siemens advisories for three of these bugs.

### How to check if you are affected

- Compare the running kernel (uname -r) with the installed package; a fixed package without a reboot is still exposed.
- Check preconditions: lsmod | grep -E 'tls|algif|ebt', sudo ebtables -t nat -L for ARP SNAT rules, and sysctl user.max_user_namespaces.
- Hunt for unexpected writes to /proc/sys/kernel/core_pattern (the published Fraggap, AF_ALG and kTLS exploits all abuse it) and root processes descended from unprivileged users or containers.
- Review journalctl -k or dmesg for oopses, use-after-free or skb warnings in tls, af_alg, ebt_snat or ip6_append_data, and preserve evidence before rebooting suspect hosts.

## What happened

Between August 26 and September 18, 2026, CISA added five Linux kernel bugs to its Known Exploited Vulnerabilities catalog. All five let a local user corrupt kernel memory and, in practice, become root. All had upstream fixes before they were listed. CISA has not said who is exploiting them or against whom, and every entry carries its forensic-triage requirement. [The Hacker News](https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html) reports that Red Hat updated its advisories for the September batch on September 19 to acknowledge exploitation and "known public exploits."

- **CVE-2025-39682 (kTLS):** a zero-length record on the kernel TLS receive list leads to a use-after-free. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2025-39682) and NVD score it 9.8 as network-reachable. [Red Hat](https://access.redhat.com/security/cve/CVE-2025-39682) scores it 7.0 and says it is remotely triggerable "only when kernel TLS ... is in use." A [kernelCTF exploit](https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2025-39682_lts_cos_mitigation) published in February 2026 sets up its own loopback kTLS connection.
- **CVE-2025-39964 (AF_ALG):** two threads writing to one crypto socket corrupt its state. The code dates to Linux 2.6.38. Its [kernelCTF write-up](https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2025-39964_lts_cos_mitigation), added August 11, 2026, needs no capabilities and no user namespaces. [Cyber Security News](https://cybersecuritynews.com/14-year-old-linux-kernel-flaw/amp/) credits STAR Labs and reports a Docker escape in a proof-of-concept setup.
- **CVE-2026-53266 (ebtables SNAT):** an ARP address rewrite copies a MAC address straight into a splice-imported file page. The CNA scores it 8.8 and notes that the required CAP_NET_ADMIN can come from a user namespace.
- **CVE-2026-53362 ("Fraggap"):** a 15-byte out-of-bounds write in the UDPv6 send path. It was [disclosed on July 20](https://www.openwall.com/lists/oss-security/2026/07/20/2) with a [public exploit](https://blog.qwerty.or.kr/en/posts/cdf3008a-c1a4-4eca-a373-aa3a2bcf1489/) used in kernelCTF. Red Hat's [RHSB-2026-009](https://access.redhat.com/security/vulnerabilities/RHSB-2026-009) warns of container escape and SELinux bypass.
- **CVE-2022-0995 (watch_queue):** an out-of-bounds write in the notification filter, [fixed in March 2022](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb). The [CVE record](https://www.cve.org/CVERecord?id=CVE-2022-0995) links two public exploits on Packet Storm. CISA added it in a [batch of six mostly older bugs](https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog).

None of these is Copy Fail (CVE-2026-31431), but two are close relatives. The AF_ALG race sits in the same socket family, and the CVE record says skcipher sockets reach it too, so blocking only `algif_aead` does not help. The ebtables bug, like Copy Fail, ends with the kernel writing into a file's cached page.

## Who is affected

Taking the highest fix per stable line from the CVE records, 5.10.259, 5.15.210, 6.1.177, 6.6.144, 6.12.95, 6.18.38 and 7.1.3 cover every bug here that applies to that line. Distribution status differs:

- **RHEL:** Red Hat's CVE data lists Fraggap as RHEL 10 only and the kTLS bug as not affecting RHEL 8. No shipped RHEL kernel was affected by CVE-2022-0995. The AF_ALG and ebtables bugs reach RHEL 7 ELS through 10. Kernels from September 22-24, 2026 cover all five.
- **Debian:** the [security tracker](https://security-tracker.debian.org/tracker/CVE-2026-53362) lists bookworm fixed in 6.1.177-1 and trixie in 6.12.95-1. Bullseye is fixed in 5.10.259-1 and not affected by the kTLS or IPv6 bugs.
- **Ubuntu:** 24.04 needs 6.8.0-147.147 for [Fraggap](https://ubuntu.com/security/CVE-2026-53362), and several 24.04 HWE and OEM kernels were still listed as vulnerable. For [the ebtables bug](https://ubuntu.com/security/CVE-2026-53266), 22.04 is fixed in 5.15.0-198.208 and 20.04 is still listed as vulnerable.

## Do you really need to act?

Yes, but on a "this week" clock, not "drop everything." Every bug needs code already running on the box. That makes them second-stage tools, used after a phished account, a compromised web app or a malicious CI job. Where tenants share a kernel, the AF_ALG bug needs no special configuration. Fraggap needs IPv6, and Red Hat adds the ability to create network namespaces, which RHEL 10 grants by default. Both have public root exploits. The ebtables bug also needs namespace privileges. Red Hat calls its exposure limited to systems with specific bridge rules. On single-user servers and laptops, risk is lower. If you have installed and booted a kernel from late September 2026 or later, you are done.

## What to do now

1. Inventory kernels: `uname -r` everywhere, then `rpm -q kernel` or `apt list --installed 'linux-image*'`.
2. Update and reboot: `dnf update kernel` or `apt-get install --only-upgrade linux-image-generic`, then reboot into the new kernel.
3. If the reboot must wait, follow Red Hat's interim mitigations: blacklist `tls` where kTLS is unused, and remove ebtables SNAT rules that rewrite ARP addresses.
4. Where rootless containers are not needed, apply RHSB-2026-009's workaround, `sysctl -w user.max_user_namespaces=0`. Deny `socket(AF_ALG, ...)` in seccomp profiles for untrusted workloads.
5. Ask appliance vendors for fixed firmware. The CVE records link Siemens advisories for three of these bugs.

## How to tell if you were hit

The [Cloud Security Alliance](https://labs.cloudsecurityalliance.org/research/csa-research-note-linux-kernel-kev-active-exploitation-20260/) notes that CISA has disclosed no details of the intrusions, and we found no published indicators as of Oct 21, 2026. Look for unexpected writes to `/proc/sys/kernel/core_pattern`, which the public Fraggap, AF_ALG and kTLS exploits all abuse. Also look for root processes descended from unprivileged users or containers, and kernel oopses that mention `tls`, `af_alg`, `ebt_snat` or `ip6_append_data` in `journalctl -k`. Capture memory and logs before rebooting a suspect host.

## Timeline

- Mar 11, 2022 — watch_queue fix for CVE-2022-0995 committed upstream.
- Sep 5, 2025 — CVE-2025-39682 (kTLS) published with stable fixes.
- Oct 13, 2025 — CVE-2025-39964 (AF_ALG) published.
- Jun 25, 2026 — CVE-2026-53266 (ebtables) published.
- Jul 20, 2026 — Fraggap (CVE-2026-53362) write-up and exploit published.
- Aug 26, 2026 — CISA adds CVE-2022-0995 to KEV. CVE-2026-53362 follows on Aug 27.
- Sep 18, 2026 — CISA adds CVE-2025-39682, CVE-2025-39964 and CVE-2026-53266, with a federal deadline of Sep 21.

## Sources

1. [CVE record — CVE-2025-39682](https://www.cve.org/CVERecord?id=CVE-2025-39682)
2. [CVE record — CVE-2025-39964](https://www.cve.org/CVERecord?id=CVE-2025-39964)
3. [CVE record — CVE-2026-53266](https://www.cve.org/CVERecord?id=CVE-2026-53266)
4. [CVE record — CVE-2026-53362](https://www.cve.org/CVERecord?id=CVE-2026-53362)
5. [CVE record — CVE-2022-0995](https://www.cve.org/CVERecord?id=CVE-2022-0995)
6. [CISA — Known Exploited Vulnerabilities: CVE-2025-39682](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39682)
7. [CISA — Known Exploited Vulnerabilities: CVE-2025-39964](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39964)
8. [CISA — Known Exploited Vulnerabilities: CVE-2026-53266](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53266)
9. [CISA — Known Exploited Vulnerabilities: CVE-2026-53362](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-53362)
10. [CISA — Known Exploited Vulnerabilities: CVE-2022-0995](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-0995)
11. [CISA — CISA Adds Six Known Exploited Vulnerabilities to Catalog (Aug 26, 2026)](https://www.cisa.gov/news-events/alerts/2026/08/26/cisa-adds-six-known-exploited-vulnerabilities-catalog)
12. [Linux kernel — watch_queue: Fix filter limit check (CVE-2022-0995 fix)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb)
13. [Red Hat — RHSB-2026-009 IPv6 Fragmentation Container Escape (CVE-2026-53362)](https://access.redhat.com/security/vulnerabilities/RHSB-2026-009)
14. [Red Hat — CVE-2026-53266](https://access.redhat.com/security/cve/CVE-2026-53266)
15. [Red Hat — CVE-2025-39682](https://access.redhat.com/security/cve/CVE-2025-39682)
16. [oss-security — CVE-2026-53362, CVE-2026-53366: OOB write in UDP MSG_SPLICE_PAGES handling](https://www.openwall.com/lists/oss-security/2026/07/20/2)
17. [qwerty — Frag Gap write-up and exploit (CVE-2026-53362)](https://blog.qwerty.or.kr/en/posts/cdf3008a-c1a4-4eca-a373-aa3a2bcf1489/)
18. [Google security-research — kernelCTF CVE-2025-39682 exploit](https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2025-39682_lts_cos_mitigation)
19. [Google security-research — kernelCTF CVE-2025-39964 exploit](https://github.com/google/security-research/tree/master/pocs/linux/kernelctf/CVE-2025-39964_lts_cos_mitigation)
20. [Debian security tracker — CVE-2026-53362](https://security-tracker.debian.org/tracker/CVE-2026-53362)
21. [Ubuntu — CVE-2026-53266](https://ubuntu.com/security/CVE-2026-53266)
22. [Ubuntu — CVE-2026-53362](https://ubuntu.com/security/CVE-2026-53362)
23. [Cloud Security Alliance — CISA Flags Three Actively Exploited Linux Kernel Flaws](https://labs.cloudsecurityalliance.org/research/csa-research-note-linux-kernel-kev-active-exploitation-20260/)
24. [Cyber Security News — 14-year-old Linux kernel flaw (CVE-2025-39964)](https://cybersecuritynews.com/14-year-old-linux-kernel-flaw/amp/)
25. [The Hacker News — CISA Flags Three Linux Kernel Flaws](https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html)

---
Source page: https://erroneo.us/security/briefs/linux-kernel-five-exploited-lpe-bugs-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt