CISA BOD 26-04 Timelines for Three Linux Kernel CVEs
2026-09-28T08:51:43Z•90923fc506cbe5d9257c8b47736be2b7a7abb27616f5bdc2fc801717a0b098b6
CVE-2025-39682CVE-2025-39964CVE-2026-53266BOD 26-04CISA KEVLinuxLinux kernelactively exploitedpatch managementvulnerability remediation
What happened
Qualys reports that CISA added three actively exploited Linux kernel vulnerabilities—CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964—to the Known Exploited Vulnerabilities Catalog on September 18, 2026. CISA BOD 26-04 imposed a three-day remediation deadline, which passed on September 21, 2026. Organizations should prioritize urgent patching, mitigation, or isolation of affected Linux assets.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- qualys_blog
- Record identifier
- 90923fc506cbe5d9257c8b47736be2b7a7abb27616f5bdc2fc801717a0b098b6
- Enrichment time
- 2026-09-28T08:51:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.