CISA Gives Agencies a 3-Day Weekend Deadline for Two Kernel Bugs
Security / news
CISA Gives Agencies a 3-Day Weekend Deadline for Two Kernel Bugs
One of the two Linux kernel flaws CISA added to its exploited-vulnerabilities catalog Sept. 18 scores a low 3.3 on CVSS, yet both share the same Sept. 21 fix-it date.
Federal agencies have until Monday to patch two Linux kernel flaws that CISA added to its Known Exploited Vulnerabilities catalog Sept. 18, one rated a low 3.3 on the CVSS scale and the other an 8.8, both already confirmed as exploited.
CISA's alert lists CVE-2025-39964 and CVE-2026-53266 with the same Sept. 21 due date, a three-day window that falls over a weekend. Binding Operational Directive 26-04 sets that kind of compressed timeline once CISA confirms a catalogued flaw is being actively exploited, regardless of how severe the flaw's score says it is.
The low-scored bug: CVE-2025-39964
This flaw sits in the Linux kernel's af_alg crypto socket interface. Two writes issued to the same socket can interleave their data unpredictably and corrupt the connection's internal state, according to the kernel's own fix description. Ubuntu's security tracker lists the CVSS score at 3.3, in the low band, but still rates the bug a Medium priority. It was published Oct. 13, 2025, nearly a year before CISA's addition, and fixes have shipped since in kernel branches 5.10.245, 5.15.194, 6.1.154, 6.6.108, 6.12.49 and 6.16.9.
The high-scored bug: CVE-2026-53266
This one carries more weight on paper. It is an out-of-bounds write in the netfilter bridge's ebtables SNAT target, where an optional rewrite of an ARP packet's sender hardware address can write past a memory page's boundary if that page came from a spliced file fragment, Ubuntu's tracker says. Rated 8.8 and a High priority, it needs only local, low-privilege access and no user interaction. It was published June 25, 2026, and fixes already exist in kernel branches 5.10.259, 5.15.210, 6.1.176, 6.6.143 and 6.12.94.
| CVE | CVSS score | Published | CISA due date |
|---|---|---|---|
| CVE-2025-39964 | 3.3 (Low) | Oct. 13, 2025 | Sept. 21, 2026 |
| CVE-2026-53266 | 8.8 (High) | June 25, 2026 | Sept. 21, 2026 |
The score understates one of these
CVSS treats CVE-2025-39964 as a minor availability problem, since NVD's vector marks no confidentiality or integrity impact. That math does not account for what CISA's catalog is actually measuring: confirmed exploitation, not theoretical severity. A three-day remediation window applied equally to a 3.3 and an 8.8 says CISA's own bar for urgency has moved past CVSS once exploitation is confirmed, a gap this month's MikroTik KEV addition showed from the opposite direction, when a 9.2-scored authentication bypass was left out of the catalog entirely.
Neither vulnerability is new. Patches for both have been available for months, some for close to a year in CVE-2025-39964's case, which means the news here is confirmation of exploitation, not the existence of the bugs. That puts this addition in the same pattern as September's other zero-day disclosures: the fix already exists, and the remaining risk sits entirely with whoever has not applied it.
CISA's alert does not name who is exploiting either flaw, how widely, or against what kind of target. Federal civilian agencies running an affected kernel branch older than the fixed versions above have until Sept. 21 to update or document why they cannot.
Sources
More in Security
- 01Rust Project Warns of New Attacks Copying North Korea's PlaybookThe Sept. 17 warning follows an August attack that Wiz traced to North Korean infrastructure through a crates.io account that shipped malware for as long as 107 minutes.
- 02Flock Safety Cameras Carry a Universal Hard-Coded KeyA teardown of a leaked Flock camera filesystem image found an 8-year-old Android security patch and firmware credentials researchers say can pull data from any unit on the network.
- 03Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 04Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.