Linux’s CVE-2025-39964 Was Exploited in 340 Days — Faster Than Its 551-Day Median (September 2026)

Our automated tracking framework flagged that CISA added CVE-2025-39964 (Linux Kernel) to the Known Exploited Vulnerabilities (KEV) catalog on September 21, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.

What CISA Reported

CISA describes the flaw as follows: “Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket’s internal state.”

Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2025-39964 by September 21, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.

The Details

How This Compares to Linux’s Track Record

This one was public for just 340 days before CISA confirmed exploitation — faster than Linux’s 551-day median, meaning attackers moved unusually quickly. Linux currently ranks #17 on our KEV Lag leaderboard.

For perspective, the median across all 1715 tracked KEV entries is 251 days — Linux’s exploited vulnerabilities are flagged slower than the catalog average.

Other Recent Linux KEV Additions

The most recent Linux vulnerabilities CISA has confirmed as actively exploited, from our tracker:

What This Means for Defenders

CISA has added CVE-2025-39964, a Linux Kernel vulnerability (CVSS 7.8), to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies must patch by September 21, 2026. All organizations using Linux Kernel-based systems should prioritize patching, especially those with public-facing or critical deployments. Active exploitation means prompt remediation is necessary to mitigate the risk of compromise.

This vulnerability was public for 340 days before its KEV listing, meaning exploitation began relatively quickly after public disclosure, leaving a smaller window for detection and pre-KEV patching. The absence of known ransomware use doesn’t diminish the urgency; adversaries may leverage this for various objectives, including initial access or privilege escalation within targeted systems.

If you can’t patch before the deadline, restrict access to affected systems using network segmentation, apply the principle of least privilege, and enhance monitoring for anomalous activity. Continue vulnerability scanning and threat hunting to detect and respond to any active exploitation until the patch can be safely deployed.

Related Coverage

• Linux’s CVE-2026-53362 Was Exploited in 54 Days — Faster Than Its 848-Day Median (August 2026)
• Linux’s CVE-2022-0995 Sat Public 1615 Days Before Exploitation — Above Its 848-Day Median (August 2026)

How We Track This

This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.