CVE-2026-53266

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert warning of active exploitation of three Linux kernel vulnerabilities. One of the flaws, CVE-2025-39964, has existed for 14 years and was demonstrated to enable privilege escalation and container escape. Public exploits exist for CVE-2025-39682 and CVE-2026-53266, with the latter having a potential privilege escalation path inferred from prior vulnerabilities like Dirty Pipe. Federal agencies are ordered to patch affected systems immediately and conduct forensic triage to detect prior compromise.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation in the wild. The vulnerabilities—CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964—allow local attackers to achieve memory disclosure, denial-of-service, or local privilege escalation. Red Hat has acknowledged active exploitation and labeled the flaws as high risk, urging immediate remediation. Federal agencies are required to patch these vulnerabilities by September 21, 2026, per Binding Operational Directive 26-04.