CISA Adds Actively Exploited Linux Kernel Vulnerability to KEV Catalog

On September 18, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2025-39682, a Linux Kernel vulnerability described as an 'Improper Check for Unusual or Exceptional Conditions.' This addition is based on evidence of active exploitation, making it a high-priority concern for organizations using affected Linux systems.

The vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies are required to prioritize rapid remediation of high-risk vulnerabilities listed in the KEV Catalog, especially those on publicly exposed assets that could grant total control of the asset post-exploitation. BOD 26-04 also mandates that agencies check for signs of compromise before applying patches.

While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities that meet the specified criteria, and organizations can nominate additional exploited vulnerabilities via CISA's KEV Nomination Form.

No specific patch details were provided in the advisory, but organizations should monitor vendor updates and apply security patches promptly. CISA's alert emphasizes the importance of checking for pre-patch compromise, as threat actors may have already exploited the vulnerability.