Linux Flaws Need Separate Checks
CISA’s catalogue lists each Linux entry as added on 18 September 2026 and due on 21 September, with forensic triage Yes and ransomware Unknown. Inclusion confirms exploitation, without identifying actors, campaigns, victims, initial access, chains or indicators.
Check distinct exposures
CVE-2025-39682: TLS receive
An unauthenticated remote peer can trigger an enabled in-kernel encrypted connection without user interaction, risking memory disclosure, corruption or a crash.
CVE-2025-39964: AF_ALG socket concurrency
An unprivileged local process, including containers or user namespaces, can race its writes, risking disclosure, corruption, privilege escalation or a crash.
CVE-2026-53266: Bridge ebtables SNAT
An out-of-bounds ARP rewrite can alter shared file-backed memory. It requires local bridge/rule control, potentially through namespace privileges; remote traffic alone is insufficient.
The 18 September alert covers only the latter two. Rapid remediation and compromise-checking duties concern covered US federal civilian agencies. Other organisations should prioritise these flaws; the federal deadline is not universal.
Backports make upstream versions inconclusive. Check Red Hat, Ubuntu, Debian, SUSE, cloud and appliance packages against the active build.
Complete six actions
- Inventory running builds, not only installed packages or deployment images.
- Map each flaw to vendor-confirmed affected and fixed builds.
- Prioritise shared hosts, containers, hosting services and build runners against their remote or local exposure.
- Reboot where required; verify the corrected build is active.
- Investigate suspicious execution, privilege changes, crashes and networking changes, following applicable forensic guidance.
- Keep vendor statements and exact-build proof for unaffected decisions.
Installation does not exclude prior compromise. Establish exposure, the running build and investigation findings separately.
