Home / Technology / CISA Issues Rare 3-Day Patch Deadline for Linux Kernel Flaws
CISA Issues Rare 3-Day Patch Deadline for Linux Kernel Flaws
22 Sep
Summary
- Three Linux kernel flaws added to CISA's Known Exploited Vulnerabilities catalog.
- Red Hat confirmed active exploitation, prompting a rare three-day patch deadline.
- Bugs allow denial-of-service, privilege escalation, and data corruption.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel flaws to its Known Exploited Vulnerabilities (KEV) catalog, indicating they are actively being exploited. These vulnerabilities, tracked as CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, have critical to high severity ratings and are now subject to an urgent three-day patching deadline for government agencies, which expires on September 21, 2026.
Red Hat has confirmed that all three flaws are being exploited in real-world attacks. The vulnerabilities can lead to memory disclosure, denial-of-service, privilege escalation, and data corruption. While patches are available for all three, specific mitigations exist for two of the flaws, though one requires applying patches as the only solution.
Typically, CISA provides a three-week patching window, making this three-day deadline exceptionally rare and highlighting the severe risk posed by these vulnerabilities. Agencies must either patch these flaws or cease using the affected product by the deadline to ensure security.
