CVE-2026-53266

🛡 We added Linux Kernal race condition vulnerability CVE-2025-39964 & out-of-bounds write vulnerability CVE-2026-53266 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/SpBCm1GlhM

米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに2件と1件の脆弱性を追加。全てLinuxカーネルで、CVE-2025-39964、CVE-2026-53266、CVE-2025-39682。対処期限は3日後の9/21。ランサムウェアによる悪用は不知。 https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-one-known-exploited-vulnerability-catalog

🚨 CISA ADDS TWO LINUX KERNEL VULNS TO KEV CATALOG CISA has added two Linux Kernel vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation (catalog date 2026-09-18). CVEs added: • CVE-2025-39964 — race condition (AF_ALG socket concurrent writes / state inconsistency) • CVE-2026-53266 — out-of-bounds write (ebtables SNAT target writing into nonlinear skb fragment) Due date: 2026-09-21 · Forensic triage required: Yes · Known ransomware use: Unknown ⚠️ Analyst Note: This is an official CISA KEV addition reflecting active exploitation evidence — not an unverified underground claim. Organizations should prioritize patching per BOD 26-04 guidance and vendor/kernel updates. CISA alert: https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog #DDW #DarkWeb #CISA #KEV #Linux #CyberSecurity

🚨 CISA ADDS LINUX KERNEL TLS CVE-2025-39682 TO KEV CISA has added CVE-2025-39682 (Linux Kernel TLS) to its Known Exploited Vulnerabilities Catalog (2026-09-18; catalog count noted at 1716) based on evidence of active exploitation. Per CISA / technical notes: • Improper check in the Linux Kernel TLS receive path • A zero-length record from rx_list can bypass intended recvmsg() record-type handling • Due date: 2026-09-21 · Forensic triage required: Yes ⚠️ Analyst Note: This is a THIRD same-day Linux Kernel KEV addition — distinct from today’s earlier pair (CVE-2025-39964 + CVE-2026-53266). Official CISA active-exploitation listing: patch ASAP and follow BOD 26-04 forensic-triage guidance where applicable. CISA alert: https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-one-known-exploited-vulnerability-catalog KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Kernel fix example: https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-39682 #DDW #DarkWeb #CVE #Linux #KEV #ThreatIntelligence #CyberSecurity

A Linux kernel networking flaw is being actively exploited (CVSS 8.8). CVE-2026-53266 is an out-of-bounds write in the ebtables SNAT target the optional ARP sender hardware address rewrite can corrupt memory when the packet fragment is backed by a spliced file page. Added to CISA's KEV catalog. Affects kernel versions from 5.4.73 up to 5.5. Remediate by Sep 21, 2026. Details: http://vulntracker.io/cves/CVE-2026-53266 #Linux #Kernel #CVE #InfoSec #CyberSecurity

CISA adds two actively exploited Linux Kernel vulnerabilities (CVE-2025-39964 & CVE-2026-53266) to the KEV Catalog. Federal agencies must prioritize patching these threats under BOD 26-04. Stay ahead with SOC Minute updates. #CISA #LinuxKernel #PatchManagement https://t.co/PfSKBnqzG6

Three Linux kernel vulnerabilities. All confirmed exploited by CISA on the same day. CVE-2025-39682 (CVSS 9.8): a remotely triggerable flaw in the TLS receive path. CVE-2026-53266 (8.8): an out-of-bounds write in netfilter's ebtables ARP rewrite. CVE-2025-39964 (7.8): a race condition in AF_ALG sockets that corrupts crypto operations. Federal deadline: September 21. If you run Linux, patch now. Details: http://vulntracker.io #Linux #CVE #CISA #VulnTracker

Who is hit: • CVE-2026-53266: unprivileged memory corruption when ebtables SNAT rewrites ARP into splice-backed page. Not default, but real on gateways. • CVE-2025-39964: AF_ALG concurrent writers → crypto corruption/DoS. • CVE-2025-39682: TLS mishandles zero-length rx_list.

CISA put 3 Linux kernel flaws on KEV yesterday—actively exploited. Federal due: Sep 21. CVE-2025-39682 (TLS zero-length rx_list), CVE-2026-53266 (ebtables SNAT ARP → OOB write), CVE-2025-39964 (AF_ALG race). Linux self-hosters/cloud VMs: update weekend, not “wait for LTS”

CISA put two Linux kernel bugs on KEV today: CVE-2025-39964 (af_alg concurrent-write race) and CVE-2026-53266 (ebt_snat ARP rewrite on bridge netfilter). Already exploited — not a theoretical advisory pile. If your fleet still treats kernel updates like quarterly hygiene, these are the ones that make that schedule look silly. AF_ALG and bridge netfilter show up on more "boring" prod boxes than people want to admit. https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog

@TheHackersNews CVE-2025-39964 is an AF_ALG socket race, CVE-2026-53266 an out-of-bounds write in the ebtables SNAT target, CVE-2025-39682 a zero-length record in the kernel TLS receive path. Added to KEV on the 18th, all three due the 21st. That is a three-day fuse.

Three severe Linux kernel vulnerabilities—CVE-2025-39682, CVE-2026-53266 & CVE-2025-39964—are now confirmed exploited in the wild. Red Hat’s advisories are live. US agencies face a patch deadline of September 21 under CISA’s KEV and BOD-26-04 mandates. Threats span privilege escalation, memory disclosure & DoS. Summary: audit local access, apply kernel updates fast. #SecurityNews #Linux #CVE #CISA #KernelVulnerabilities #PrivEsc #SecurityNews #Linux #Kernel #CVE #CISA #PrivEsc #Vulnerabilities https://thedailytechfeed.com/cisa-adds-three-critical-linux-kernel-bugs-to-exploited-list/

【古いLinuxは移行対象です】 ・CVE-2026-53266がKEV入り ・EoLなら利用停止・移行 ・対応期限は9月21日 古い基盤ほど、移行判断が急務です。 #パッチ管理 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-53266

CVE-2026-53266: Κρίσιμη ευπάθεια στο ebtables SNAT του Linux Kernel https://www.secnews.gr/734341/cve-2026-53266-ebtables-snat-linux/?fsp_sid=13437

News: CISA put Linux kernel CVE-2025-39964 (AF_ALG race) and CVE-2026-53266 (ebtables SNAT write) on KEV Sep 18. Hits unpatched Linux hosts; both under active use. Apply your distro kernel update now; if stuck, blacklist af_alg and drop ebtables ARP rewrite. https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog

Linux kernel CISA KEV (today): CVE-2025-39964 and CVE-2026-53266. AF_ALG race condition and out-of-bounds write. CISA cites active exploitation evidence. Patch or roll vendor kernel updates across managed Linux fleets now. #CVE #KEV

🔒 #CyberSecurity CISA KEV Alert: CVE-2025-39964 and CVE-2026-53266 Linux Kernel Exploits — Detec… "On September 18, 2026, CISA added two Linux kernel vulnerabilities to its Known Exploited…" 🔗 https://securityarsenal.com/blog/cisa-kev-alert-cve-2025-39964-and-cve-2026-53266-linux-kernel-exploits-detection-and-remediation-guide #CyberSecurity #ThreatIntel #critical #zeroday #cve

TRC analysis shows attackers exploiting Linux kernel vulnerabilities CVE-2025-39964 and CVE-2026-53266 to gain root privileges and move laterally across network segments. Runtime segmentation helps contain post-compromise activity when kernel-level access is achieved. #ZeroTrust 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/cisa-kev-linux-kernel-cve-2025-39964-cve-2026-53266-september-2026

🔒 #CyberSecurity CVE-2026-53266: Linux Kernel ebtables SNAT Out-of-Bounds Write Under Active Exp… "On September 18, 2026, CISA added CVE-2026-53266 to the Known Exploited…" 🔗 https://securityarsenal.com/blog/cve-2026-53266-linux-kernel-ebtables-snat-out-of-bounds-write-under-active-exploitation-detection-and-remediation-guide #CyberSecurity #ThreatIntel #cve202653266 #critical #cisakev

CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability CVSS 8.8 · EPSS 0.1% · 1 public exploit https://notcve.org/cve/CVE-2026-53266 https://t.co/0Mssmz1K4Y