Linux Kernel: Three Exploited Flaws, One Overdue Deadline

Three separate Linux Kernel vulnerabilities added on September 18 share a September 21 deadline that is now past. This clustering is significant — it signals that threat actors are actively chaining or independently exploiting kernel-level primitives, and organizations running unpatched Linux distributions are already operating outside BOD 26-04 compliance.

CVE-2025-39682 targets the TLS receive path, where a zero-length record can bypass recvmsg() record-type handling, corrupting zero-copy and queuing assumptions for subsequent TLS records. In high-throughput environments — containerized microservices, Kubernetes ingress controllers, or TLS-terminating proxies — this could be leveraged to manipulate encrypted traffic processing at the kernel level. CVE-2025-39964 is a race condition on AF_ALG sockets, the kernel's cryptographic API interface. Concurrent writes cause unpredictable data interleaving, creating exploitable inconsistencies in socket state — a meaningful risk on multi-tenant systems where shared cryptographic operations are common. CVE-2026-53266 is the most structurally dangerous of the three: an out-of-bounds write in the ebtables SNAT target, where an ARP rewrite operation can corrupt a splice-imported file page in a nonlinear socket buffer. This type of memory corruption primitive is precisely what kernel exploit chains are built around.

CISA explicitly flags that affected kernel versions may be end-of-life. DevOps and platform engineering teams should audit their base images, container runtimes, and VM templates immediately. Transitioning to a supported, patched kernel is the only sustainable remediation — backporting is not viable on EoL branches. For teams operating under change-freeze conditions, runtime exploit mitigations such as seccomp profiles, SELinux/AppArmor enforcement, and network namespace isolation provide meaningful — though incomplete — compensating controls.

Privilege Escalation at the Edge: Mobile, Backup, and Identity Tooling

Three September 16 additions round out the week by targeting the supporting infrastructure that security teams often treat as lower-risk — and attackers do not.

CVE-2026-58704 — Google Pixel Improper Authorization in the cellular modem — represents the intersection of mobile device management and physical security risk. The vulnerability's logic error allows privilege escalation through the modem layer, outside the Android permission model. Organizations issuing Pixel devices to personnel with access to classified or sensitive systems should treat this as a high-priority MDM push. The September 19 deadline has passed; verify patch status through your EMM console today.

CVE-2026-87886 — Acronis Backup Incorrect Default Permissions for its cPanel/WHM and Plesk plugins — is a quiet but dangerous supply-chain pivot point. Backup agents operate with elevated system privileges by design, and misconfigured default permissions create a reliable local privilege escalation path. Hosting providers and managed service providers using these plugins should audit file system permissions against vendor hardening guidance immediately, as exploitation could grant an attacker root or SYSTEM access on backup infrastructure touching multiple client environments.

Taken together, this week's KEV additions form a coherent attack surface map: perimeter bypass via Cisco and Zyxel, kernel-level exploitation via Linux, and privilege escalation through mobile, backup, and identity tooling. No single patch resolves the exposure — security leaders should treat this batch as a coordinated remediation sprint, not a routine patch cycle.

Sources: CISA KEV Catalog · Cisco Security Advisories · Zyxel Security Advisories · Google Android Security Bulletins · Acronis Security Advisories · Linux Kernel CVE Tracker · CISA BOD 26-04