Observed Signal · Sep 22, 2026 · Security Advisory · Source: t3n · Impact: 3/5 · Sentiment: Negative
CISA flags three actively exploited Linux kernel flaws
The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities Catalog (KEV), indicating they are being actively exploited. The flaws, tracked as CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, are rated as 'critical' or 'high' severity. Red Hat has confirmed exploitation via publicly known exploits. The vulnerabilities can lead to system crashes, privilege escalation, and remote code execution. CISA has ordered US federal agencies to patch affected systems within three days or temporarily take them offline. Patches are available in the kernel, and administrators are urged to apply them urgently. No details on the threat actors or targets have been disclosed yet.
Critical Linux vulnerabilities actively exploited pose a threat to digital infrastructure underpinning AdTech, but the impact is indirect and general IT security news.
Track Red Hat Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your Polaris7 workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- CISA added three Linux kernel vulnerabilities to its KEV catalog: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964.
- Red Hat confirmed that all three vulnerabilities are exploited in real attacks via publicly known exploits.
- CVE-2025-39682 involves an error in processing empty TLS records in kernel TLS, potentially leading to system crashes and code injection.
- CVE-2026-53266 is a memory issue in the netfilter bridge code that can cause system crashes and privilege escalation by local attackers.
- CVE-2025-39964 is a race condition in the AF_ALG cryptographic kernel interface that can allow data tampering or system crashes.
- Patches for all three vulnerabilities are available in the Linux kernel.
- CISA gave US federal agencies three days to patch the affected systems or take them offline.
Connected Companies & Entities
“Linux provider Red Hat has confirmed that all three vulnerabilities are exploited in real attacks.”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
US warns of CopyFail Linux kernel bug
The U.S. cybersecurity agency CISA warned that a severe Linux kernel vulnerability nicknamed "CopyFail" (CVE-2026-31431) is being actively exploited. The flaw, discovered in kernel versions 7.0 and earlier and disclosed in late March, corrupts kernel data allowing local privilege escalation to root. Researchers and vendors verified the bug in major distributions — including Red Hat Enterprise Linux 10.1, Ubuntu 24.04 LTS, Amazon Linux 2023, and SUSE 16 — and reported it affects Debian, Fedora and Kubernetes environments. Kernel patches were released roughly a week after disclosure but have not fully propagated across distributions. CISA has added the issue to its Known Exploited Vulnerabilities catalog and ordered U.S. civilian federal agencies to patch affected systems by May 15. Microsoft and security firms warn CopyFail can be chained with remote exploits or delivered via supply-chain or phishing vectors to fully compromise servers and data centers.
Kernel CVE Response: 3 Priorities for Infrastructure
This technical article outlines three operational priorities for infrastructure teams responding to a critical kernel CVE: (1) determine the true scope and urgency by assessing CVSS score, exploit status, affected OS/kernel versions and hardware, and potential impact (e.g., RCE or privilege escalation); (2) apply low-risk, temporary mitigations such as kernel module blacklisting, sysctl tuning, firewall rules (iptables/nftables), and configuration changes to reduce exposure until patches are available; (3) apply official kernel patches via a controlled process that includes staging tests, comprehensive scenarios, phased rollout (canary), monitoring (journalctl, dmesg, Prometheus/Grafana/ELK), and a rollback plan. The article uses illustrative CVE examples (CVE-2024-XXXX with CVSS 9.8; CVE-2024-YYYY) and provides command-level checks (uname -r, netstat, iostat, vmstat).
Critical Cisco Bug Exploited Since 2023, Global Alert Issued
Cisco disclosed a critical vulnerability (CVSS 10.0) in its Catalyst SD‑WAN product family that allows remote attackers to gain full, persistent privileged access to affected devices. Cisco’s researchers found evidence of exploitation dating back to 2023, and some impacted organizations are described as critical infrastructure. Governments including Australia, Canada, New Zealand, the United Kingdom and the United States issued warnings; U.S. agency CISA ordered civilian federal agencies to patch by the end of the specified Friday citing imminent threat. Cisco and governments did not publicly attribute the attacks to a named threat actor, though Cisco tracked a cluster of activity as UAT‑8616. The disclosure follows a December advisory for another actively exploited Cisco vulnerability in Async software.
Receive all future signals for Red Hat & competitors in your briefing
Never miss material M&A deals, leadership changes, account wins, or product rollouts. Polaris7 monitors 20,000+ primary sources 24/7, delivering verified telemetry directly into your executive briefing.