Linux Kernel: 3 CVEs Added to CISA KEV on the Same Day — kTLS, ebtables and AF_ALG

On September 18, 2026, CISA added three Linux kernel vulnerabilities to its KEV catalog with a three-day deadline. Three different subsystems, no score published by NVD at the time of writing, and an unusual note in two of the entries: the affected product could be end-of-life.

KEV added: 2026-09-18. CISA deadline: 2026-09-21.

I'm relying on the CISA descriptions; I won't invent a score or give a kernel version number — and we'll see why a version number wouldn't be enough anyway.

The Three Flaws

CVE-2025-39682 — kTLS

[...] a zero-length record retrieved from the rx_list [may] bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions.

kTLS offloads TLS encryption into the kernel for high-throughput servers. An empty record breaks the receive queue state, and the rest of the stream is processed under wrong memory assumptions. It only concerns systems where kTLS is actually in use.

CVE-2026-53266 — ebtables SNAT

[...] allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page.

The most worrying of the three. A page imported via splice() can belong to a file's page cache. Writing into it potentially means altering the contents of a file the caller may only read. The mechanism is reminiscent of the Dirty Pipe family (2022) — that's a reading of the description, not vendor-published information, but it's the severity assumption to work with.

CVE-2025-39964 — AF_ALG

[...] allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state.

AF_ALG exposes kernel cryptography to user programs. Race conditions in this subsystem have been used as local privilege escalation primitives before.

What they share

All three are exploited locally. They belong to the second half of an intrusion: the attacker has a foothold — an application account, a container — and wants root. For a host, a Kubernetes platform or any multi-tenant server, a container is no boundary against a kernel flaw: they all share the same one.

Why uname -r Isn't Enough

Distributions backport fixes into their own kernel versions. An Ubuntu 5.15.0-xxx may contain a fix missing from a newer upstream 5.15.y, and vice versa. Comparing a version number against an upstream list yields false positives and false negatives.

The right source is your distribution's security advisory for each CVE:

# Debian / Ubuntu
apt changelog linux-image-$(uname -r) 2>/dev/null | grep -E "CVE-2025-39682|CVE-2026-53266|CVE-2025-39964"

# RHEL / Rocky / Alma
rpm -q --changelog kernel-$(uname -r) | grep -E "CVE-2025-39682|CVE-2026-53266|CVE-2025-39964"

Above all: a kernel that's installed but not booted protects nothing.

uname -r                                   # running kernel
ls /boot/vmlinuz-* | sort -V | tail -1     # latest installed kernel

If they differ, the machine is waiting for a reboot.

Reducing the Surface in the Meantime

All three subsystems are modules most servers don't use. If they aren't needed, preventing them from loading removes the flaw regardless of the patch:

# Check what's loaded
lsmod | grep -E "^tls|ebtable|ebt_snat|algif"

# /etc/modprobe.d/cve-2026-09.conf
install ebt_snat /bin/false
install algif_aead /bin/false
install algif_skcipher /bin/false
install algif_hash /bin/false
# tls: only if kTLS isn't used (check your nginx / HAProxy config)
install tls /bin/false

Test before rolling out: some disk encryption and VPN tools use AF_ALG, and high-throughput web servers use kTLS.

Detection

Kernel exploits leave few direct traces. The useful signals:

• Kernel oopses and warnings: dmesg -T | grep -iE "BUG|oops|general protection|KASAN" — failed attempts often crash something
• Unusual loading of ebt_snat or algif_* modules on machines with no use for them
• Root processes whose ancestry traces back to an application account or a container
• Modified system files with no package update (debsums -c, rpm -Va) — relevant to CVE-2026-53266

Mitigation

1. Update the kernel through your distribution and reboot — the CISA deadline was September 21.
2. Disable unused modules listed above.
3. On end-of-life machines flagged by CISA: there will be no fix; the only answer is migration.
4. Multi-tenant platforms: prioritise nodes running third-party code (Kubernetes, CI, shared hosting).

Why Continuous Monitoring of Your Kernels Matters

Three kernel CVEs in KEV on the same day, on subsystems nobody thinks to inventory, with version numbers that mean nothing outside the distribution's context. That's exactly where manual tracking fails.

With cveo.tech, inventory your Linux servers with their distribution and kernel, and get alerted whenever a critical KEV-listed CVE affects them.