The three CVEs CISA added share nothing in terms of subsystem, but they share a pattern: each one lives in a part of the kernel that almost every distribution ships turned on by default. The Hacker News's write-up lists CVE-2025-39682, a CVSS 9.8 flaw in the TLS receive path where a zero-length record retrieved from the kernel's internal rx_list can slip past the checks recvmsg() is supposed to apply to it; CVE-2026-53266, a CVSS 8.8 out-of-bounds write in the netfilter bridge's ebtables SNAT target that corrupts memory when a crafted ARP rewrite rule fires; and CVE-2025-39964, a CVSS 7.8 race condition that lets concurrent writes land on the same AF_ALG cryptographic socket, an on-disk state that outlives the offending code path in a way local-only bugs usually don't.
CISA's catalog entry does more than ask for a patch
All three were added to the Known Exploited Vulnerabilities catalog on 18 September, with federal civilian agencies given until 21 September - today - under Binding Operational Directive 26-04 to act. What's easy to miss is what "act" means under BOD 26-04 for a vulnerability capable of handing an attacker full control of the asset: the directive doesn't stop at "apply the patch," it requires agencies to check whether the system was already compromised before the fix went in. Red Hat's own advisory, quoted in the same coverage, is blunt about why: "This CVE is high risk and there are known public exploits leveraging this vulnerability. Address this vulnerability with high priority." None of the three write-ups name a threat actor or describe how exploitation was first spotted - which is itself the point. CISA doesn't wait for attribution before it moves a bug onto this list, and neither should a patch queue that's waiting to hear a name before it reprioritises.
The four exploits that landed the same week, and why the gap between them matters
Separately, and with no connection to CISA's catalog addition, a researcher published working root-exploit code for four kernel networking bugs nicknamed DirtyAH6, TUNderflow, PPPoEject and DiagSpill - detailed in a technical breakdown published the following day. The distinction the write-up draws is the one worth sitting with: the KEV trio is "about flaws with evidence of exploitation in the wild," while the four exploits are "about flaws with public proof-of-concept code and no reported real-world attacks" - yet. Three of the four need unprivileged user namespaces enabled to reach root from an ordinary account; disable that feature on a host and, in the researcher's own words, "the ordinary-user path to DirtyAH6, TUNderflow and PPPoEject is closed." DiagSpill doesn't care - it needs nothing but the SCTP module and a non-default trigger option most hosts have never touched. None of the four are remote-root worms; reaching root remotely with DirtyAH6 took the researcher careful memory shaping in his own lab, and he describes doing it from a genuinely remote starting position as "extremely difficult." But every one of them starts from exactly where an attacker sits after a successful phishing click, a stolen web-shell, or a compromised container - which is to say, exactly where most real intrusions already are by the time privilege escalation becomes the next move.
Today's proof-of-concept is next month's KEV entry
The useful way to read these two stories together isn't "three bugs are urgent, four are theoretical." It's that the trio CISA flagged this week started out exactly like the four PoCs did: a technical write-up, then confirmed exploitation, then a KEV addition and a federal deadline. Nothing about DirtyAH6 or DiagSpill promises they'll stay proof-of-concept code for long, and a patch cycle that only escalates once something reaches the exploited list is, by definition, always reacting to yesterday's threat model rather than this week's.
- Patch CVE-2025-39682, CVE-2026-53266 and CVE-2025-39964 on every internet-facing and container-host Linux system now, not on the next scheduled kernel maintenance window.
- Where BOD 26-04 doesn't legally apply to you, adopt its forensic-triage principle anyway: for any KEV addition capable of full asset compromise, check for signs of prior compromise before you patch, not just after.
- Audit whether unprivileged user namespaces are enabled by default across your fleet - if a workload doesn't need them, disabling the feature closes three of the four newly public root-exploit paths outright.
- Treat published kernel proof-of-concept code as a countdown, not a curiosity - build a fast-track review path for any PoC targeting a component you run at scale, rather than waiting for it to appear on an exploited-vulnerabilities list first.
- Ask whoever owns your container and CI runner fleet specifically about SCTP module usage - DiagSpill needs no special privilege configuration at all, which makes it the easiest of the four to trip over by accident.
Kernel patching gets deprioritised precisely because it looks routine, and routine is exactly the disguise these bugs are wearing this week. If you'd like a second opinion on how your Linux fleet's patch cadence compares to what CISA is now treating as urgent, email sales@halfteck.com.