CISA Adds Actively Exploited Linux Kernel Flaws CVE-2026-53266 and CVE-2025-39964 to KEV List

CISA added two Linux kernel vulnerabilities — CVE-2026-53266, an out-of-bounds write, and CVE-2025-39964, a race condition — to its Known Exploited Vulnerabilities catalog on 18 September 2026, citing evidence of active exploitation. The KEV listing shifts CVE-2026-53266 from a routine patch task to an immediate operational priority, regardless of its assigned severity score. Security teams are advised to check their distribution's backport status rather than relying solely on upstream kernel version numbers to determine exposure. Where immediate patching is not possible, organizations should restrict network and local access to the affected subsystem as a temporary compensating control. These mitigations are intended as short-term measures with a defined expiry and do not replace applying the official kernel update.