CISA BOD 26-04 Timelines for Three Linux Kernel CVEs

Key Points:

• Three actively exploited Linux kernel vulnerabilities (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) have been added to CISA's KEV Catalog, with a 3-day remediation deadline for CVE-2025-39682 and varying deadlines for the others.
• These vulnerabilities can lead to severe impacts, including memory disclosure, denial of service, local privilege escalation, and system crashes across a substantial number of internet-facing assets.
• Immediate patching is crucial; organizations should prioritize updating affected systems using High-Reliability Patches provided by Qualys TruRisk Eliminate.

Technical Details: CVE-2025-39682 involves a flaw in the TLS receive path that can cause memory disclosure or denial of service. CVE-2026-53266 allows out-of-bounds writes leading to potential privilege escalation or denial of service. CVE-2025-39964 presents a race condition that can result in system crashes or corrupted cryptographic results.

MITRE ATT&CK Techniques: None mentioned

IOCs Mentioned: None mentioned