CISA adds two exploited Linux kernel flaws to KEV: af_alg race and ebtables ARP write

CISA added two Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog on 18 September 2026, citing evidence of active exploitation [2]. Both entries carry a remediation due date of 21 September 2026 — three days after listing [1].

The two CVEs are CVE-2025-39964, a race condition in the kernel’s AF_ALG crypto socket interface, and CVE-2026-53266, an out-of-bounds write in the netfilter bridge ebt_snat target [2]. Known ransomware use is recorded as Unknown for both [1].

The required action recorded for CVE-2025-39964 is the standard BOD 26-04 wording: apply vendor mitigations, follow the directive’s guidance for cloud services, and discontinue use of the product where no mitigation is available [1]. The KEV data we hold shows the same text for CVE-2026-53266, but the sources we cite do not reproduce that entry’s action field directly. The directive also sets expectations for checking whether a system was compromised before the patch was applied [2]. BOD 26-04 binds Federal Civilian Executive Branch agencies only, but CISA recommends risk-based prioritisation of KEV entries for everyone [2].

The advisory does not name any threat actor, campaign, or exploitation technique, and it does not say whether the two bugs are being used together or independently. Treat the exploitation claim as CISA’s assertion without published corroborating detail.

Who is affected

Any system running an unpatched Linux kernel that exposes the affected code paths. In practice that means servers, container hosts, network appliances, and embedded devices — the kernel is the kernel regardless of the distribution on top of it.

Neither source states which kernel version ranges are vulnerable or which upstream releases contain the fixes. Both CVE descriptions are written in the upstream “vulnerability has been resolved” form, so fixes exist in mainline, but you will need your distribution’s advisory to map that to a package version. That mapping is the load-bearing detail missing here.

For AF_ALG, exposure depends on whether userspace can open AF_ALG sockets at all. For the netfilter bug, exposure depends on the bridge netfilter path and ebtables SNAT rules being in use. Bridged networking is common on virtualisation and container hosts.

How it works

CVE-2025-39964 (af_alg). The upstream fix disallows concurrent writes in af_alg_sendmsg. Two simultaneous writes to the same AF_ALG socket interleave data unpredictably and can leave the socket’s internal state inconsistent. The patch adds a ctx->write field that marks exclusive write ownership. CVSS v3.1 base score 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — local access, low privileges required, no user interaction, full impact on confidentiality, integrity and availability within the same scope.

CVE-2026-53266 (netfilter bridge). The ebtables SNAT target can optionally rewrite the ARP sender hardware address, and it does so with skb_store_bits() at an offset measured from skb->data. The problem is that the earlier skb_header_pointer() call only establishes that the ARP header can be read safely; it says nothing about whether the sender-hardware-address bytes further on are safe to modify. Where those bytes still sit in a nonlinear skb fragment whose page was imported by splice from a file, the store maps that page and writes the new MAC into it. The fix makes the ARP sender-hardware-address range writable before the header is read and before the store. The commit notes that the Ethernet source rewrite is deliberately left behind skb_ensure_writable(skb, 0) to avoid reintroducing an earlier small-packet regression. CVSS v3.1 base score 8.8, vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — the changed scope reflects impact beyond the vulnerable component.

The practical read: a write into a page imported from a file gives an attacker a way to corrupt memory the kernel did not intend to hand over. The sources do not describe a working exploit chain, so do not assume a specific outcome beyond what the CVSS vectors state.

Both are local-access issues. That does not make them minor. Local privilege escalation primitives are what turn a web-app foothold or a container breakout attempt into host control, and BOD 26-04 is aimed specifically at exposed assets where post-exploitation grants total control of the asset [2].

What to do

• If you are an FCEB agency, the deadline is 21 September 2026 [1]. Patch or document mitigation status against BOD 26-04 now, and apply the directive’s compromise-check expectations to anything you patch late.
• Pull your distribution’s kernel advisory for both CVEs and patch to the fixed package version. Do not rely on the upstream commit description to judge whether your build is affected.
• Reboot after patching. Live-patching services may cover one or both of these; confirm with your vendor rather than assuming.
• Reduce AF_ALG exposure where you do not need userspace crypto sockets — restrict or block the address family for untrusted workloads and containers.
• Inventory ebtables SNAT usage on bridge hosts. If the ARP MAC rewrite option is not in use anywhere, your exposure to CVE-2026-53266 is narrower, though patching remains the fix.
• Prioritise multi-tenant hosts first: container platforms, shared CI runners, VM hypervisors, and anything where an untrusted process already runs locally.
• Check for prior compromise on internet-exposed hosts before closing the ticket. CISA lists these as actively exploited, so a patch alone does not answer whether you were hit.