INFRA Signal 283
Linux’s new KEV trio gets a 9.8 score — Red Hat rates it 7.9
↗
CISA added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch or stop using affected products by September 21, 2026.
Federal agencies must remediate three actively exploited kernel flaws before the deadline, and the differing CVSS scores highlight varying risk levels that affect patch prioritization and mitigation strategies.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
CISA added three Linux kernel CVEs to its KEV catalog with a September 21, 2026 patch deadline for federal agencies.
CVE-2025-39682 received a 9.8 CVSS score from NVD but Red Hat assigned it 7.9 due to higher attack complexity and conditional exposure.
Only systems using kernel TLS (CONFIG_TLS) and the kTLS ULP are vulnerable to the remotely reachable flaw, allowing targeted mitigation via module blocking.
THE READ
What the cluster adds up to.
The event marks the first time CISA has added multiple Linux kernel vulnerabilities to its KEV catalog, signaling a shift toward stricter federal remediation timelines for open-source components.
The disparity between the 9.8 and 7.9 scores illustrates how contextual factors, such as required kTLS configuration and attack complexity, can produce divergent severity assessments despite identical CVE identifiers.
Because exploitation has already occurred, merely applying patches is insufficient; agencies must perform forensic triage to detect potential compromise on already-affected systems.
The narrow exposure model of CVE-2025-39682 means that generic vulnerability scoring does not capture the real-world limitation to environments where kernel TLS is actively used, affecting the breadth of impact analysis.
Local privilege escalation paths tied to ebtables SNAT and AF_ALG socket handling remain relevant for post-compromise scenarios, underscoring the need for comprehensive kernel hardening beyond the high-scoring remote flaw.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER