Unverified CISA KEV Claim Lists Two Linux Kernel Flaws

En bref

• Claimed CISA KEV additions: CVE-2025-39964 and CVE-2026-53266.
• Both are described as Linux kernel vulnerabilities: a race condition and an out-of-bounds write.
• The advisory URL is dated September 18, 2026, which is in the future.
• BOD 26-04 would require federal agencies to prioritize KEV-listed flaws.
• Treat the claim as unverified until CISA publishes a current alert.

A recent item attributed to CISA claims that two Linux kernel vulnerabilities have been added to the Known Exploited Vulnerabilities Catalog: CVE-2025-39964, described as a race condition, and CVE-2026-53266, described as an out-of-bounds write. The same item states that CISA has evidence of active exploitation and references Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize KEV-listed flaws on exposed assets. However, the provided URL carries a publication date of September 18, 2026. As of May 9, 2026, that date is in the future, so the alert cannot be confirmed as a real CISA publication.

That future date is the central problem. A legitimate CISA KEV update would not be published months ahead of the current date. The discrepancy could indicate a placeholder, a typo, a test entry, or a fabricated notice. Without a live, current CISA page or a matching vendor advisory, the claim should not be treated as verified. The CVE identifiers themselves may be real or reserved, but that alone does not prove active exploitation or KEV inclusion.

If the claim were accurate, the impact would be significant. Linux kernel race conditions and out-of-bounds write flaws can lead to privilege escalation, denial of service, or arbitrary code execution. K-12 districts often run Linux on web filters, DNS servers, file shares, virtual hosts, and network appliances. A kernel flaw that is actively exploited could let an attacker move from a low-privileged account to full control of a system.

CISA's KEV Catalog is a trusted prioritization source, and BOD 26-04 reinforces rapid remediation for high-risk CVEs. Even though most school districts are not federal agencies, many follow KEV guidance to focus limited IT resources. That makes accuracy critical: acting on a false KEV entry wastes time, while ignoring a real one leaves systems exposed.

Until CISA publishes a current, verifiable alert, treat this item as unconfirmed. Watch the official KEV Catalog, your Linux distribution's security advisories, and CISA's news page for a matching entry. If the CVEs appear in a legitimate advisory, move quickly to inventory, test, and patch affected kernels.

À faire maintenant

1. Verify the KEV entry directly at cisa.gov/known-exploited-vulnerabilities-catalog before taking action.
2. Inventory Linux kernel versions across servers, appliances, and endpoints.
3. Subscribe to your Linux distribution's security advisory feed for CVE-2025-39964 and CVE-2026-53266.
4. If the CVEs are confirmed, test and deploy vendor kernel updates during the next maintenance window.
5. Enable logging and monitoring for privilege escalation or unexpected kernel crashes on Linux assets.
6. Review BOD 26-04 requirements if you support federal systems; otherwise use KEV as a prioritization guide.
7. Document any unpatched Linux systems and apply compensating controls until patches are available.

Références CVE

• CVE-2025-39964
• CVE-2026-53266

Source originale

CISA Advisories