CISA issues urgent three-day patch deadline for critical Linux kernel vulnerabilities

The US Cybersecurity and Infrastructure Security Agency (CISA) has added three critical Linux kernel vulnerabilities—CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964—to its Known Exploited Vulnerabilities (KEV) catalog. These flaws, which enable denial-of-service attacks, privilege escalation, and data corruption, are currently being exploited in the wild. Red Hat has confirmed the high-risk nature of these bugs and provided necessary patches across various kernel versions. Due to the severity of the threats, CISA has mandated that federal agencies apply security updates within an unusually short three-day window, expiring September 21, 2026. While some vulnerabilities offer temporary mitigations, such as disabling specific modules or rules, experts strongly recommend immediate patching as the only definitive security measure. Users are urged to verify their kernel versions and apply the latest stable updates provided by their distribution maintainers to mitigate potential system compromise.