Three Linux Kernel Bugs Land on CISA's List With Mismatched Scores

The Cybersecurity and Infrastructure Security Agency added three Linux kernel flaws to its Known Exploited Vulnerabilities catalog on Sept. 18, giving federal civilian agencies until Sept. 21 to patch. The most severe of the three carries three different severity scores from three different reviewers who disagree about what an attacker actually needs to exploit it.

The number that travels is the highest one

CISA's catalog entry for CVE-2025-39682 describes a flaw in the Linux kernel's kernel TLS (kTLS) code, which moves the encryption work for TLS-protected connections into the kernel itself to cut down on data copies between user space and the network stack. A zero-length record retrieved from an internal queue can bypass the kernel's own type-checking for TLS records, corrupting how later records are handled. The Linux kernel's CVE-issuing authority scored the bug 9.8 out of 10, with an attack vector of network, meaning it assumed a remote attacker with no prior access. Every outlet that has covered the catalog addition, including The Hacker News, repeated that 9.8 figure without noting that anyone else scored it differently.

Where the second opinion breaks with the first

NVD's own record for the same CVE carries a second score: 7.1, with the attack vector changed from network to local. That is not a rounding difference. An attack vector of local means NVD's analysts concluded an attacker needs an existing foothold on the machine, not just a network path to it, and their score drops the integrity-impact rating from high to none. Red Hat's own advisory lands on a third number, 7.0, keeping the network attack vector but raising the attack complexity to high and cutting both the confidentiality and integrity impact to low. Three organizations read the same kernel patch and produced three different judgments about how it can be reached and what it exposes.

Reviewer	Score	Attack vector	Impact
Linux kernel CNA	9.8	Network	Confidentiality, integrity, availability: high
NVD	7.1	Local	Confidentiality: high; integrity: none
Red Hat	7.0	Network, high complexity	Confidentiality, integrity: low

1. Linux kernel CNA9.8 score out of 10
2. NVD7.1 score out of 10
3. Red Hat7 score out of 10

Source: NVD and Red Hat CVE records, accessed Sept. 19, 2026

Why the same kernel patch produces three numbers

NVD has rescored a growing share of CNA-assigned CVEs since a 2024 processing backlog pushed the agency to prioritize entries by exploitation status rather than publish every incoming score unchanged. A rescoring does not mean the original CNA got the code wrong; it means two sets of analysts read the same kernel commit and answered the CVSS rubric's attack-vector question differently, specifically whether kTLS is reachable by an unauthenticated peer sending crafted network traffic or requires a process already running on the host. Vendors that maintain their own advisories on top of NVD entries, as Red Hat does for every kernel CVE it ships, routinely add a third number for the same reason: each organization is scoring the deployment it knows, complete with its own default configuration and compiled options, not an abstract code path in isolation.

The other two flaws split the same way

The catalog's second entry, CVE-2025-39964, is a race condition that lets concurrent writes to the same AF_ALG cryptographic-socket interface corrupt each other. The kernel's CNA scored it 7.8; NVD rescored it to 5.5, dropping both the confidentiality and integrity impact to none and leaving only availability. The third, CVE-2026-53266, is an out-of-bounds write in the netfilter bridge's ebtables SNAT target, where an ARP sender hardware-address rewrite can write directly into a nonlinear socket-buffer fragment sourced through splice. It carries only the CNA's 8.8 score. NVD has not published its own rating for it, which means one-third of this week's catalog addition has had no second opinion at all. Red Hat's advisory for CVE-2025-39682 acknowledges public exploit code and recommends blacklisting the kernel's tls module as a stopgap, under solution number 41278, for systems that cannot be patched immediately.

The timeline matters more than any of the three scores

CVE-2025-39682 has been a public CVE record since Sept. 5, 2025, more than a year before CISA's addition. CVE-2025-39964 followed on Oct. 13, 2025. CVE-2026-53266, by contrast, became public June 25, 2026, under three months before landing in the catalog alongside two flaws that sat unflagged for far longer. Whichever score is right, all three kernel fixes have been available through the normal stable-tree update process since before CISA's addition, the same distinction this desk drew when CISA split a MikroTik RouterOS attack chain across two separate catalog entries: a flaw that has been patchable for a year is a different kind of failure than one flagged the week it is found, even when both land in the same list on the same day. What would change this account is a fourth scoring body, ideally the kernel's own security team rather than a CNA process, weighing in on which attack vector is correct; until then, an organization patching by severity alone would prioritize CVE-2026-53266's unreviewed 8.8 over CVE-2025-39682's contested 9.8, which is close to backward from how the public conversation has framed the addition. Similar scoring gaps recur often enough in CISA's own catalog work on Chrome's sixth zero-day of the year that treating the catalog's inclusion, rather than any single number, as the operative signal is the safer default for anyone triaging this list on Sept. 21.