CISA BOD 26-04 Timelines for Three Linux Kernel CVEs | Qualys
Summary: CISA added three actively exploited Linux kernel vulnerabilities - CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964 - to its KEV Catalog on September 18, 2026, triggering a 3-day remediation deadline that passed on September 21. Under BOD 26-04, CVE-2025-39682 carries a 3-day window across all assets, while the other two get 3 days for publicly exposed assets and 14 days for internal ones, with Red Hat updating advisories for all three to acknowledge active exploitation and known public exploits.
Bottom line: The 3-day deadline for exposed assets has already passed, and CISA marked all three flaws as requiring forensic triage - meaning the question is no longer whether to patch but whether an unpatched kernel already allowed an intrusion to go deeper than a single application.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-39682CVE-2025-39964CVE-2026-53266
- Related
- CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability Known Exploited Vulnerabilities · Sep 18, 2026CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Sep 18, 2026CVE-2025-39964: Linux Kernel Race Condition Vulnerability Known Exploited Vulnerabilities · Sep 18, 2026