Our automated tracking framework flagged that CISA added CVE-2026-53362 (Linux Kernel) to the Known Exploited Vulnerabilities (KEV) catalog on August 29, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. ”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-53362 by August 30, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-53362 |
| Vendor / product | Linux Kernel |
| Vulnerability | Linux Kernel Unspecified Vulnerability |
| CVSS base score | 7.8 |
| Added to KEV | August 27, 2026 |
| Days public before listing (NVD → KEV lag) | 54 |
| Federal patch deadline | August 30, 2026 |
| Known ransomware use | No |
How This Compares to Linux’s Track Record
This one was public for just 54 days before CISA confirmed exploitation — faster than Linux’s 848-day median, meaning attackers moved unusually quickly. Linux currently ranks #14 on our KEV Lag leaderboard.
| Linux in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 28 |
| Median lag (public → KEV listing) | 848 days |
| 0-day rate (exploited at or before disclosure) | 0% |
| Entries tied to known ransomware campaigns | 2 |
For perspective, the median across all 1684 tracked KEV entries is 267 days — Linux’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Linux KEV Additions
The most recent Linux vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2022-0995 | Kernel | August 26, 2026 | 1615 | No |
| CVE-2022-0492 | Kernel | June 2, 2026 | 1552 | No |
| CVE-2026-31431 | Kernel | May 1, 2026 | 9 | No |
| CVE-2018-14634 | Kernel | January 26, 2026 | 2680 | No |
| CVE-2021-22555 | Kernel | October 6, 2025 | 1552 | No |
What This Means for Defenders
CISA has added CVE-2026-53362, an unspecified vulnerability in the Linux Kernel, to its Known Exploited Vulnerabilities (KEV) catalog. It has a CVSS base score of 7.8, and federal agencies must patch by August 30, 2026. This 3-day window to patch for federal agencies signals CISA’s assessment of an immediate and significant threat. Organizations using Linux Kernel-based systems should prioritize patching, especially those with internet-facing assets or critical internal services.
This CVE was added to the KEV catalog just 54 days after its public disclosure, a faster turnaround than many vulnerabilities. While there’s no known ransomware use, the rapid KEV listing suggests that exploitation was detected quickly after public knowledge, leaving little time for detection and mitigation before active attacks.
For systems that can’t be patched before the August 30 deadline, security teams should implement compensating controls. These include isolating vulnerable systems, restricting network access, applying least-privilege principles, and enhancing monitoring for unusual activity. Patch before the deadline; if you cannot, restrict access to vulnerable systems and monitor for exploitation attempts.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
