Two disclosures landed on the Linux kernel within a day of each other. Both point the same direction.
Friday brought the federal stamp. Three kernel bugs joined CISA’s Known Exploited Vulnerabilities catalog, each with evidence of active abuse. A TLS receive path flaw, CVE-2025-39682, scores 9.8 and lets a local user pull memory or force a denial of service. An out-of-bounds write in the ebtables Source NAT ARP rewrite path, CVE-2026-53266, scores 8.8 and can reach local privilege escalation.
The lowest of the three, CVE-2025-39964 at 7.8, is a race condition affecting AF_ALG sockets. Concurrency bugs there can take a host down or produce corrupted cryptographic output. Red Hat confirmed exploitation on September 19, and federal civilian agencies have until September 21 under BOD 26-04.
Then, on September 18, researcher Asim Manizada published working exploits for four privilege escalation bugs he reported in July: DirtyAH6 (CVE-2026-80844), TUNderflow (CVE-2026-81000), PPPoEject (CVE-2026-68121) and DiagSpill (CVE-2026-74469). Three need unprivileged user namespaces, which most distributions enable by default. DiagSpill needs no special privileges where the SCTP module is loaded. The coding mistakes behind them are 10 to 21 years old.
Stable releases carrying all four fixes begin at 5.10.270, 6.1.188, 6.6.157 and 7.2.4, but check your distribution’s advisory rather than matching upstream numbers. Disabling unprivileged user namespaces closes three of the four paths, though not DiagSpill. Manizada’s advice is to patch rather than switch features off.
