The Week the Road to Local Root Opened All at Once — Linux Kernel LPEs Hit CISA's KEV Catalog as Public Exploits Land

On September 18, 2026, CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation: CVE-2025-39682 (CVSS 9.8, an improper condition check in the kernel TLS receive path allowing memory disclosure or denial-of-service), CVE-2026-53266 (CVSS 8.8, an out-of-bounds write in the netfilter bridge ebtables SNAT ARP rewrite path enabling local privilege escalation), and CVE-2025-39964 (CVSS 7.8, a race condition allowing concurrent writes to the same AF_ALG socket). Federal civilian agencies were given until September 21 to apply fixes. For none of the three has CISA published campaign details or threat-actor attribution, and whether they form a single attack chain remains unclear. What is known: Red Hat updated the advisories for all three as of September 19 to state that the CVE is high risk and known public exploits exist, urging high-priority remediation (per The Hacker News, CISA, and Red Hat).

The same day, a separate current widened the kernel attack surface. Security researcher Asim Manizada had reported four local privilege escalation (LPE) flaws to the Linux kernel security team in mid-July — DirtyAH6 (CVE-2026-80844, IPsec AH6), TUNderflow (CVE-2026-81000, TUN/TAP virtual network devices), PPPoEject (CVE-2026-68121, PPPoE), and DiagSpill (CVE-2026-74469, SCTP's sctp_diag). On September 18, after a coordinated hold so distributions could ship fixes, he published technical write-ups with working exploits. All four are fixed in current kernels and there are no reports of real-world use. But three of the four — DirtyAH6, TUNderflow, PPPoEject — presuppose that unprivileged user namespaces are enabled, a feature many distributions enable by default; the fourth, DiagSpill, requires no special privileges at all as long as the SCTP module is available (per The Hacker News reporting).

Analysis (separated from facts): the same-day landing of both stories marks a shift of emphasis from the 'entrance' to 'what comes after.' Last week this observatory covered root compromise of internet-facing boundary appliances — Cisco ISE and the Secure Email Gateway. Boundary appliances are reachable by design, so the 'is it exposed' question answers itself; this week's kernel flaws are all local-first (remote triggering is narrow and crash-centric). What matters from an attacker's perspective is the growing menu of paths from an initial foothold on a shared host to root. Container hosts, CI runners, multi-tenant servers, and AI workload environments are all assets whose operating assumption is 'multiple parties hold low-privileged shells here' — every public exploit that lands lowers the cost of lateral movement. The published exploits reportedly require tuning to specific kernel builds and can crash the machine; that is a statement about development cost, not about exploitability.

Defensive implications: (1) The three KEV entries are subject to the forensic-triage requirements of CISA's BOD 26-04, not just patching — reviewing logs for pre-patch compromise is the baseline. (2) User namespaces are essential for many workloads, but on servers that do not need them, disabling them is worth evaluating: the fact that three of the four new LPEs presuppose this single default setting shows how much kernel attack surface hangs on one configuration choice. (3) On shared hosts, inventory the structure itself — tenant isolation, ephemeral CI runners, isolating AI workloads — alongside per-CVE patching, because 'one person gets root, everyone loses' is a design property, not a patch level. (4) Since kernel-space compromise is invisible to user-space agents, complementing with eBPF-based runtime detection and kernel-integrity monitoring is a realistic option. Facts here draw on CISA's KEV alert (https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog), The Hacker News coverage of the KEV additions (https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html) and of the four LPE disclosures (https://thehackernews.com/2026/09/public-exploits-released-for-four-linux.html), and Red Hat's advisory (https://access.redhat.com/security/cve/cve-2025-39682). Analysis is kept separate from reporting.