Di week wey di road to local root open all at once — Linux kernel LPEs enter CISA KEV catalog as public exploits land
For 18 September, CISA add three Linux kernel flaws wey dem dey actively exploit (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) to di KEV catalog and Red Hat confirm say public exploit code dey. Di same day, working exploits for four kernel LPEs (DirtyAH6, TUNderflow, PPPoEject, DiagSpill) come out under coordinated disclosure. We dey look why shared-host privilege escalation dey follow boundary appliances into di spotlight.
Dis article na machine translation.
For 18 September 2026, CISA add three Linux kernel vulnerabilities to im Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation: CVE-2025-39682 (CVSS 9.8, improper condition check for di kernel TLS receive path wey allow memory disclosure or denial-of-service), CVE-2026-53266 (CVSS 8.8, out-of-bounds write for di netfilter bridge ebtables SNAT ARP rewrite path wey enable local privilege escalation), and CVE-2025-39964 (CVSS 7.8, race condition wey allow concurrent writes to di same AF_ALG socket). Federal civilian agencies get until 21 September to apply fixes. For none of di three CISA publish campaign details or threat-actor attribution, and whether dem form single attack chain still no clear. Wetin dem sabi: Red Hat update di advisories for all three as of 19 September to talk say di CVE na high risk and known public exploits dey, and dem urge high-priority remediation (according to The Hacker News, CISA, and Red Hat).
Di same day, separate current widen di kernel attack surface. Security researcher Asim Manizada don report four local privilege escalation (LPE) flaws to di Linux kernel security team for mid-July — DirtyAH6 (CVE-2026-80844, IPsec AH6), TUNderflow (CVE-2026-81000, TUN/TAP virtual network devices), PPPoEject (CVE-2026-68121, PPPoE), and DiagSpill (CVE-2026-74469, SCTP sctp_diag). For 18 September, after coordinated hold so distributions fit ship fixes, e publish technical write-ups with working exploits. All four don fix for current kernels and no report of real-world use dey. But three of di four — DirtyAH6, TUNderflow, PPPoEject — dey need say unprivileged user namespaces dey enabled, feature wey many distributions enable by default; di fourth, DiagSpill, no need any special privilege at all as long as di SCTP module dey available (according to The Hacker News reporting).
Analysis (wey we separate from facts): di same-day landing of both stories mark shift of emphasis from di «entrance» to «wetin come after». Last week dis observatory cover root compromise of internet-facing boundary appliances — Cisco ISE and di Secure Email Gateway. Boundary appliances dey reachable by design, so di question «e dey exposed?» dey answer itself; dis week kernel flaws all na local-first (remote triggering dey narrow and crash-centric). Wetin matter from attacker side na di menu wey dey grow of paths from initial foothold on shared host to root. Container hosts, CI runners, multi-tenant servers, and AI workload environments all na assets wey operating assumption na «more than one party hold low-privileged shells here» — every public exploit wey land dey lower di cost of lateral movement. Di published exploits, as dem report, need tuning to specific kernel builds and fit crash di machine; dat na statement about development cost, no be about exploitability.
Wetin e mean for defense: (1) Di three KEV entries dey subject to di forensic-triage requirements of CISA BOD 26-04, no be just patching — to review logs for compromise before patch na di baseline. (2) User namespaces dey essential for many workloads, but on servers wey no need dem, to disable dem worth to evaluate: di fact say three of di four new LPEs dey need dis single default setting show how much kernel attack surface hang on one configuration choice. (3) On shared hosts, inventory di structure itself — tenant isolation, ephemeral CI runners, isolating AI workloads — alongside patching per CVE, because «one person get root, everybody lose» na design property, no be patch level. (4) Since kernel-space compromise no dey visible to user-space agents, to complement with eBPF-based runtime detection and kernel-integrity monitoring na realistic option. Facts here draw on CISA KEV alert (https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog), The Hacker News coverage of di KEV additions (https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html) and of di four LPE disclosures (https://thehackernews.com/2026/09/public-exploits-released-for-four-linux.html), and Red Hat advisory (https://access.redhat.com/security/cve/cve-2025-39682). Analysis dey kept separate from reporting.