CISA KEV Catalog Update: Actively Exploited Linux Kernel Vulnerabilities

Technical Analysis

CVE-2025-39964 is a race condition vulnerability in the Linux kernel that can lead to memory corruption or use-after-free conditions when concurrent operations are improperly synchronized, potentially enabling privilege escalation or denial of service. CVE-2026-53266 is an out-of-bounds write vulnerability that allows an attacker to write beyond allocated memory buffers, which can be leveraged for arbitrary code execution or kernel-level compromise. Both vulnerabilities affect the Linux kernel, a foundational component running on servers, containers, and cloud infrastructure worldwide, and their inclusion in the KEV catalog confirms active exploitation in the wild. Exploitation of kernel-level flaws grants attackers total control of the underlying host, making them especially dangerous on internet-facing or multi-tenant systems. Because Linux hosts widely underpin AI agent deployments, LLM inference servers, container orchestration for agent pipelines, and RAG infrastructure, successful exploitation could allow attackers to escalate privileges, pivot laterally, and exfiltrate API keys, model weights, or vector database credentials used by agentic systems.

Affected Systems

Linux kernel versions vulnerable to CVE-2025-39964 and CVE-2026-53266; specific affected kernel version ranges should be confirmed via the official CVE records and distribution vendor advisories (e.g., Red Hat, Debian, Ubuntu, SUSE) as patches are released.

Indicators of Compromise

• No specific IOCs (hashes, IPs, domains) provided in source data; monitor CISA KEV Catalog and vendor advisories for exploitation indicators.

Remediation Steps

1. 1

   Apply Kernel Patches

   Update affected Linux systems to patched kernel versions as soon as vendor fixes are released for CVE-2025-39964 and CVE-2026-53266.

2. 2

   Prioritize Internet-Facing Assets

   Following BOD 26-04 guidance, prioritize remediation on publicly exposed assets where exploitation grants full system control.

3. 3

   Compromise Assessment

   Check whether systems were compromised prior to patching, per BOD 26-04 requirements, especially for systems handling sensitive credentials or agent workloads.

4. 4

   Harden Agent Infrastructure

   For organizations running AI agents, LLM inference, or RAG pipelines on Linux hosts, rotate API keys and credentials if compromise is suspected, and isolate agent workloads from unpatched systems.

5. 5

   Monitor KEV Catalog

   Continuously track CISA's KEV Catalog for newly added vulnerabilities and integrate this into vulnerability management workflows.