[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fva8oMp4GdpbpjJ4E9w2I0uLZCQrhfQNUU_zaHnOrOLE":3},{"article":4,"iocs":43,"watch_terms":54,"solutions":55,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"7597ba5a-c45f-4dce-92ba-1236cd7bc5ed","CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild","cisa-flags-three-linux-kernel-vulnerabilities-exploited-in-the-wild-7abc6b","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2025-39682 (CVSS score: 9.8) - An improper check for unusual or exceptional conditions vulnerability in the TLS receive path","CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. These flaws, including CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, can lead to memory disclosure, denial-of-service, and privilege escalation. Federal agencies are advised to patch these vulnerabilities by September 21, 2026, as per Binding Operational Directive (BOD) 26-04.","CISA adds three actively exploited Linux kernel vulnerabilities to its KEV catalog.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fcisa-flags-three-linux-kernel.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgcKuQ4GC9r1-4fQ3Ap_CQko0y3nMI0SnATF3WNSv48uFtNskrV4PqnyW4s0L7sXcojrHoJCEZRazGJNz5JhxrTTSYZSAQeD-xwdquE3X7pJ_ylBUerrybIiaE3V-i1vXdiLr_N1KCM9GTmeAKLlgySqEr0QeCB5ckvnppiEHSZhnEqv0IfUnqCKdA1kKsN\u002Fs1600\u002Fcisa-linux.jpg","2026-09-19T06:24:10+00:00","2026-09-19T08:00:13.757217+00:00",9,[17,20,23],{"name":18,"type":19},"Linux kernel","product",{"name":21,"type":22},"CISA","vendor",{"name":24,"type":22},"Red Hat","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,38],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48,51],{"type":45,"value":46,"context":47},"cve","CVE-2025-39682","Linux kernel vulnerability in TLS receive path",{"type":45,"value":49,"context":50},"CVE-2026-53266","Linux kernel vulnerability in ebtables SNAT ARP rewrite path",{"type":45,"value":52,"context":53},"CVE-2025-39964","Linux kernel vulnerability in AF_ALG socket race condition",[21,24,18],{"controls":56,"vendors":143},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":42,"name":116,"problem":117,"products":118},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":160},"active-linux-kernel-exploits-demand-urgent-patching","Active Linux Kernel Exploits Demand Urgent Patching","CISA has flagged three actively exploited Linux kernel vulnerabilities capable of causing memory disclosure, denial-of-service, and privilege escalation — a dangerous combination that could allow attackers to fully compromise affected systems. The fact that these flaws are already being exploited in the wild means organizations cannot afford a slow patch cycle; threat actors are actively leveraging these weaknesses before defenders can respond. Federal agencies face a hard deadline under BOD 26-04, but all organizations running Linux-based infrastructure should treat this with equivalent urgency regardless of regulatory obligation. Privilege escalation vulnerabilities are particularly severe, as they can allow an attacker who gains initial access to quickly elevate to root or kernel-level control, bypassing most defensive controls. This incident underscores the critical need for continuous vulnerability tracking and rapid remediation processes tied to threat intelligence feeds like the CISA KEV catalog.",[149,150,151,152,153,154,155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 18: Penetration Testing","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST AC-6: Least Privilege","CISA Binding Operational Directive (BOD) 22-01: Known Exploited Vulnerabilities Catalog","CISA BOD 26-04","ITIL 4: Change Enablement (emergency change procedures)","NIST CSF 2.0: Respond (RS.MI): Incident Mitigation",{}]