Linux’s CVE-2026-53266 Was Exploited in 85 Days — Faster Than Its 551-Day Median (September 2026)

Our automated tracking framework flagged that CISA added CVE-2026-53266 (Linux Kernel) to the Known Exploited Vulnerabilities (KEV) catalog on September 20, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.

What CISA Reported

CISA describes the flaw as follows: “Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.”

Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-53266 by September 21, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.

The Details

How This Compares to Linux’s Track Record

This one was public for just 85 days before CISA confirmed exploitation — faster than Linux’s 551-day median, meaning attackers moved unusually quickly. Linux currently ranks #17 on our KEV Lag leaderboard.

For perspective, the median across all 1715 tracked KEV entries is 251 days — Linux’s exploited vulnerabilities are flagged slower than the catalog average.

Other Recent Linux KEV Additions

The most recent Linux vulnerabilities CISA has confirmed as actively exploited, from our tracker:

What This Means for Defenders

CISA has added CVE-2026-53266, a Linux Kernel vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog. With a CVSS base score of 8.8, it’s a high-severity threat. Federal agencies must patch by September 21, 2026, only three days after its KEV listing on September 18, 2026. This tight deadline indicates an immediate threat, especially for organizations using Linux Kernel-based systems.

The vulnerability was public for 85 days before its KEV listing. This provided a detection window, but the rapid federal deadline implies exploitation has recently become more widespread or impactful. There’s no known ransomware use associated with CVE-2026-53266, which might slightly reduce immediate financial extortion risk, but not the overall security threat.

Patch CVE-2026-53266 before September 21, 2026. If you cannot, restrict network access to affected Linux Kernel systems, deploy intrusion detection/prevention systems to monitor for exploitation attempts, and enhance endpoint detection and response visibility. Prioritize patching for internet-facing Linux systems and those hosting critical services to mitigate the severe risk.

Related Coverage

• Linux’s CVE-2026-53362 Was Exploited in 54 Days — Faster Than Its 848-Day Median (August 2026)
• Linux’s CVE-2022-0995 Sat Public 1615 Days Before Exploitation — Above Its 848-Day Median (August 2026)

How We Track This

This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.