Our automated tracking framework flagged that CISA added CVE-2025-39682 (Linux Kernel) to the Known Exploited Vulnerabilities (KEV) catalog on September 19, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2025-39682 by September 21, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2025-39682 |
| Vendor / product | Linux Kernel |
| Vulnerability | Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability |
| CVSS base score | 9.8 |
| Added to KEV | September 18, 2026 |
| Days public before listing (NVD → KEV lag) | 378 |
| Federal patch deadline | September 21, 2026 |
| Known ransomware use | No |
How This Compares to Linux’s Track Record
This one was public for just 378 days before CISA confirmed exploitation — faster than Linux’s 551-day median, meaning attackers moved unusually quickly. Linux currently ranks #17 on our KEV Lag leaderboard.
| Linux in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 31 |
| Median lag (public → KEV listing) | 551 days |
| 0-day rate (exploited at or before disclosure) | 0% |
| Entries tied to known ransomware campaigns | 2 |
For perspective, the median across all 1715 tracked KEV entries is 251 days — Linux’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent Linux KEV Additions
The most recent Linux vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2025-39964 | Kernel | September 18, 2026 | 340 | No |
| CVE-2026-53266 | Kernel | September 18, 2026 | 85 | No |
| CVE-2026-53362 | Kernel | August 27, 2026 | 54 | No |
| CVE-2022-0995 | Kernel | August 26, 2026 | 1615 | No |
| CVE-2022-0492 | Kernel | June 2, 2026 | 1552 | No |
What This Means for Defenders
CISA has added CVE-2025-39682, an Improper Check for Unusual or Exceptional Conditions Vulnerability in the Linux Kernel, to its Known Exploited Vulnerabilities (KEV) catalog. With a CVSS base score of 9.8, this critical vulnerability demands immediate attention from all organizations utilizing Linux Kernel-based systems, especially those with internet-facing deployments. The federal patch deadline is exceptionally tight, set for September 21, 2026, just three days after its KEV listing on September 18, 2026. This urgency reflects active, in-the-wild exploitation. Security teams should prioritize patching efforts without delay.
This CVE was public for 378 days before its KEV addition, which is significantly faster than the historical median lag of 551 days for Linux vulnerabilities added to the KEV catalog. This indicates a more rapid progression from disclosure to observed exploitation than typically seen for Linux Kernel issues, reinforcing the critical need for prompt action. While no known ransomware use is reported, the high CVSS score and confirmed exploitation suggest the potential for severe impact, including system compromise and data loss.
Organizations unable to apply the patch before the deadline must implement robust compensating controls. These may include network segmentation to isolate vulnerable systems, stringent access controls, monitoring for unusual activity indicative of exploitation, and applying additional layers of security such as intrusion prevention systems. A comprehensive risk assessment should be conducted for unpatched systems to identify and mitigate potential exposure points.
Related Coverage
- Linux’s CVE-2026-53362 Was Exploited in 54 Days — Faster Than Its 848-Day Median (August 2026)
- Linux’s CVE-2022-0995 Sat Public 1615 Days Before Exploitation — Above Its 848-Day Median (August 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
