Two Linux Kernel Flaws Just Made CISA’s Exploit List
On September 18, 2026, CISA added two Linux kernel vulnerabilities to its Known Exploited Vulnerabilities Catalog. That catalog only gets updated when there’s real-world evidence of active exploitation, not just theoretical risk. If your business runs any Linux-based systems, servers, firewalls, or network appliances, this is a patching conversation you need to have now.
The two CVEs are CVE-2025-39964, a race condition vulnerability in the Linux kernel, and CVE-2026-53266, an out-of-bounds write vulnerability. Both classes of flaw are serious. Race conditions can let an attacker execute code by timing operations in a way the kernel doesn’t expect. Out-of-bounds writes can corrupt memory and open a path to full system compromise.
Why This Matters Even If You’re Not a Federal Agency
CISA’s Binding Operational Directive 26-04 requires federal agencies to patch KEV Catalog vulnerabilities fast, especially ones that grant total control of a system after exploitation. These two qualify. Federal agencies don’t get to sit on them.
You’re not a federal agency. But the same threat actors targeting federal systems also target small and mid-size businesses. The KEV Catalog is useful precisely because it reflects what’s actually being used in attacks right now. Treating it as a patching priority list is one of the smarter things an IT team can do, and it’s free.
We’ve covered this before. The pattern of actively exploited vulnerabilities landing in the KEV Catalog and catching businesses unprepared keeps repeating. The businesses that get hit hardest are the ones treating patching as a quarterly task instead of an ongoing process.
What to Check Right Now
Linux shows up in more places than most business owners realize. It’s not just dedicated Linux servers. Think about:
- Network-attached storage devices
- Firewalls and UTM appliances from vendors like Fortinet, Sophos, or Ubiquiti
- Virtualization hosts running KVM or Proxmox
- Any cloud-connected appliances or IoT gateways on your network
For each of those, the question is the same: what kernel version is it running, and has the vendor released a patch that addresses CVE-2025-39964 or CVE-2026-53266? If you don’t know the answer off the top of your head, that’s the gap to close first.
The Patch Window Is Short
CISA’s directive sets remediation timelines for federal agencies based on risk level, with the highest-risk vulnerabilities, the ones granting total control of a system, getting the shortest windows. That framing is worth borrowing even if you’re not bound by the directive. An out-of-bounds write that can fully compromise a system shouldn’t sit on a backlog for three weeks while someone waits for the next change window.
Vendor updates for Linux-based appliances can lag behind upstream kernel patches by days or weeks. That’s normal, but it means you need to be watching vendor security advisories actively, not just waiting for automatic updates that may not come.
If your team manages Windows endpoints through Intune or Windows Update for Business, the patching workflow there is more structured. Linux-based infrastructure often gets less attention, and that’s exactly where gaps form.
Check your asset inventory, confirm which systems are running Linux-based software, and get vendor patch status confirmed before the end of the week. If you don’t have a clear asset inventory, that problem needs fixing before the next CVE drops. Exine helps businesses across NJ and NYC build and maintain that kind of managed IT and cybersecurity for businesses so patching decisions are based on facts, not guesswork.
FAQ
Does CVE-2025-39964 affect Windows servers?
No. Both CVE-2025-39964 and CVE-2026-53266 are Linux kernel vulnerabilities. Windows systems are not affected. However, network appliances, storage devices, and security tools running Linux-based firmware on your network may be vulnerable even if your workstations run Windows.
How do I know if my firewall or appliance is affected?
Check your vendor’s security advisory page for mentions of CVE-2025-39964 or CVE-2026-53266. Vendors like Fortinet, Sophos, and others publish CVE-specific advisories. If you can’t find one, contact your vendor’s support directly and ask explicitly about these two CVEs.
What is CISA’s KEV Catalog and should I follow it?
The KEV Catalog is CISA’s list of vulnerabilities confirmed to be actively exploited in the wild. It’s free, updated regularly, and one of the most practical patching priority tools available. Any organization managing IT infrastructure should check it regularly, not just federal agencies.
