CISA's 3-Day Linux Kernel Deadline Hid a Scoring Fight

CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog Sept. 18 and gave federal civilian agencies until Sept. 21, a three-day window, to patch them under Binding Operational Directive 26-04. That deadline has already passed, the same compressed turnaround the agency used this month for a maximum-severity Cisco ISE flaw.

The three flaws sit in unrelated kernel subsystems: the TLS receive path, the netfilter bridge's ebtables SNAT target, and the AF_ALG cryptographic socket interface. CISA's alerts do not name an attacker or say how the flaws are being exploited, only that exploitation has been observed, the same limited disclosure the agency gave when it added a Zyxel switch flaw to the catalog days earlier.

Three subsystems, one deadline

CVE	Subsystem	CVSS v3.1
CVE-2025-39682	TLS receive path (kTLS)	9.8
CVE-2026-53266	netfilter bridge ebtables SNAT	8.8
CVE-2025-39964	AF_ALG crypto socket interface	7.8

CVE-2025-39682, the most severe of the three, lets a zero-length record on the kernel's TLS receive list bypass the checks that decide how the next record is decrypted, according to the vulnerability's own description in the National Vulnerability Database. Red Hat's advisory says the flaw "is relevant when kernel TLS, commonly called kTLS, is enabled and attached to TCP sockets," a precondition that limits it to systems that have turned kTLS on rather than every Linux host running a network service.

A CVSS score that depends on who is asked

CVE-2025-39964, a race condition in the AF_ALG interface that lets two concurrent writes to the same crypto socket corrupt its internal state, carries two official CVSS scores that do not agree. NVD's own analysts rate it 5.5, a medium score that assumes only an availability impact. The Linux kernel's own CVE numbering authority rates the same flaw 7.8, a high score built on full confidentiality, integrity and availability impact.

1. NVD analyst score5.5 score out of 10
2. Linux kernel CNA score7.8 score out of 10

Source: National Vulnerability Database, accessed 2026-09-22

CISA's own KEV catalog entry does not pick a side; it lists the flaw without endorsing either number. An agency triaging patches by CVSS alone would rank this one behind CVE-2026-53266 using NVD's score, or ahead of it using the kernel's own score. The gap is 2.3 points, enough to change which system gets patched first if a team is short on time.

What CISA is asking agencies to do beyond patching

BOD 26-04 does not treat these three the way it treats most catalog additions. Alongside the Sept. 21 deadline, CISA's alerts require agencies to check "whether threat actors compromised the system before the patch was applied," a forensic-triage step the directive normally reserves for vulnerabilities that grant "total control of the asset post-exploitation." That is a materially bigger ask than installing a kernel update, and it is not optional for any agency running an affected version.

CVE-2026-53266 requires a system already configured with bridge netfilter rules that rewrite ARP sender hardware addresses through ebtables SNAT, a setup common on network appliances rather than general-purpose servers. Red Hat said a local attacker who finds that configuration "could trigger memory corruption, denial of service, or potential privilege escalation," which is consistent with the kernel's own precondition for CVE-2025-39964: an attacker who already has a local account on the box.

None of the three alerts says which agencies, if any, found evidence of prior compromise once they went looking, and CISA has not said whether the forensic-triage requirement turned up anything before the Sept. 21 deadline came and went.