CISA Adds Three Linux Kernel CVEs to KEV Catalog Amid Red Hat Confirmation of Active Exploits

The three flaws affect the TLS receive path, ebtables SNAT ARP rewrite, and AF_ALG socket handling respectively. All require local access and yield memory disclosure, privilege escalation, or denial-of-service. Red Hat updated its advisories the same day to note public exploits, aligning with CISA's KEV listing under BOD 26-04. No technical indicators of compromise or attack chains have been released by either agency.

Independent researcher Asim Manizada disclosed four additional local privilege-escalation issues the same week, including DirtyAH6 and TUNderflow. These create plausible post-exploitation paths from the KEV-listed bugs, yet CISA and Red Hat provide no linkage data. The timing suggests coordinated disclosure rather than isolated incidents, a pattern seen in prior kernel exploit campaigns tracked via NVD and vendor changelogs.

Evidence consists solely of the KEV catalog entry and Red Hat statements; no packet captures, exploit samples, or attribution artifacts have surfaced publicly. This leaves open whether the activity stems from commodity malware or targeted operations. Federal Civilian Executive Branch agencies must patch by 21 September, creating an observable compliance signal in procurement and vulnerability management records.

Downstream Linux distributions will likely backport fixes within 72 hours. Operators should audit local user access controls and monitor for anomalous AF_ALG or ebtables activity, as these vectors remain viable until patches propagate.