Four exploited flaws in four days: three in the Linux kernel and one in Zyxel switches

Four exploited flaws in four days: three in the Linux kernel and one in Zyxel switches

22 September 2026 — The US Cybersecurity and Infrastructure Security Agency added four vulnerabilities to its catalogue of flaws known to be exploited between 18 and 21 September. Each carries a federal remediation deadline three days after it was listed, and CISA has marked all four for forensic triage. That means agencies must check whether a system was compromised before the patch, not only apply it.

Three Linux kernel flaws, listed on 18 September

• CVE-2025-39964, a race condition in AF_ALG crypto sockets. Concurrent writes to the same socket can corrupt its internal state.
• CVE-2026-53266, an out-of-bounds write in the ebtables SNAT target. An ARP sender-address rewrite can write straight into a socket-buffer fragment backed by a file page.
• CVE-2025-39682, a zero-length record in the kernel TLS receive path. It can slip past record-type handling and cause later records to be processed on the wrong assumptions.

The federal deadline for all three was 21 September. CISA's catalogue records ransomware use as unknown for each.

The patch position is uneven. On 22 September, Ubuntu's page for CVE-2026-53266 showed a fix for the 26.04 LTS kernel and for the 7.0 hardware-enablement kernel on 24.04. The standard kernels on 24.04 LTS and 22.04 LTS were still marked "vulnerable, work in progress", and 20.04 as vulnerable. A fleet on Ubuntu's default kernels may not have a fix to install yet.

A Zyxel switch flaw, listed on 21 September

CVE-2026-7273 is a stack-based buffer overflow in the web management program of Zyxel's GS1900 series smart switches, which are common in small and mid-sized offices. An unauthenticated attacker on the local network can send a crafted HTTP request and potentially run operating-system commands on the switch. Zyxel patched it on 16 June for ten models, from the GS1900-8 to the GS1900-48HPv2. Firmware 2.90(xxxx.1)C0 and earlier is affected, and 2.90(xxxx.2)C0 fixes it. The federal deadline is 24 September. Exploitation was confirmed three months after the patch shipped: the fix has been available since June, and the exposure is switches that were never updated.

What to do

• Patch where a fix exists. Apply your distribution's kernel updates and reboot into them. Flash GS1900 switches to the fixed firmware for their model.
• Where no fix exists yet, follow your distribution's own advisory for the flaw. Mitigations reported second-hand should be checked on the distributor's page before you rely on them.
• Look for compromise, not just the version. All four are exploited in the wild. A host or switch patched today may already have been used.
• Take switch management off the office network. The Zyxel flaw needs local network access to the management interface. Limiting that interface to a management VLAN narrows who can reach it.

CISA's deadlines bind only US federal civilian agencies, but the agency asks every organisation to prioritise the catalogue. For private buyers it is the most reliable public list of what attackers are actually using.

Sources

• CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog" — 18 September 2026
• CISA, "CISA Adds One Known Exploited Vulnerability to Catalog" (Linux kernel TLS flaw) — 18 September 2026
• CISA, "CISA Adds One Known Exploited Vulnerability to Catalog" (Zyxel GS1900) — 21 September 2026
• CISA Known Exploited Vulnerabilities catalogue feed, version 2026.09.21 (read 22 September 2026) — 22 September 2026
• Ubuntu Security, CVE-2026-53266 (last updated 22 September 2026) — 22 September 2026
• Zyxel security advisory for GS1900 series switches, CVE-2026-7273 — 16 June 2026