Linux kernel bug CVE-2025-39964 is being actively exploited — but details are thin on the ground
CISA says the flaw is confirmed as exploited in the wild and has given US federal agencies days to patch, yet the public record says almost nothing about what the bug does or who it hits.
What we actually know
A Linux kernel vulnerability tracked as CVE-2025-39964 has been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalogue. CISA added it on 18 September 2026 and, unusually, gave US federal civilian agencies just three days — until 21 September — to apply a fix. That short window is CISA’s way of signalling this isn’t a theoretical risk: entry into the KEV list means the agency has evidence the bug is being exploited right now, not merely that a security researcher has flagged it as dangerous.
That’s about the extent of what’s confirmed. CISA’s own listing gives the vendor (Linux) and product (Kernel), the dates, and a generic instruction to “apply mitigations in accordance with vendor instructions” — standard boilerplate that appears against every entry in the catalogue, not detail specific to this flaw. The NVD record for the CVE exists but, at time of writing, offers no meaningful technical breakdown either. So no confirmed detail is publicly available yet on the type of bug (memory corruption, privilege escalation, use-after-free — take your pick, the kernel has seen all of them), which subsystem is affected, or which kernel versions are vulnerable.
So who is actually at risk
This is where scepticism is warranted. “Linux kernel” is not a product — it’s the foundation running everything from your home router and Android phone to cloud servers, smart TVs and industrial control systems. Without knowing the affected subsystem or kernel version range, it is impossible to say with any confidence whether this touches consumer devices, server fleets, embedded kit, or some narrow combination of the three.
What we do know is who CISA’s deadline actually applies to: US federal civilian executive branch agencies, under a binding operational directive. It does not compel anyone else — not UK government bodies, not businesses, not home users — to do anything. CISA’s KEV catalogue exists primarily as a prioritisation tool for that specific slice of the US government, though security teams everywhere use it as a signal of what’s worth taking seriously.
“Ransomware: Unknown” is also listed against the entry, meaning CISA hasn’t tied this to any known ransomware campaign — for now.
What to do about it
Given the sparse public detail, the sensible move for anyone running Linux systems — server administrators, IT teams, embedded device maintainers — is the boring one: keep kernels updated through your normal distribution or vendor patch channels, and watch for a security advisory from your Linux distribution (Debian, Red Hat, Ubuntu and so on) that names the specific fix. Distribution maintainers typically move fast once a KEV-listed kernel bug surfaces, and their advisories will actually say what’s broken and how to fix it, unlike the KEV entry itself.
For ordinary readers, there’s no need to panic. You are not a federal agency with a 72-hour compliance clock, and most consumer Linux exposure comes indirectly through routers, NAS boxes or Android devices that get patched by manufacturers on their own schedules.
The takeaway
A kernel bug is confirmed as actively exploited, and that’s worth logging. But right now the record shows a deadline and a CVE number, not a clear picture of the vulnerability, its scope, or its real-world blast radius. Worth watching for a proper technical writeup — not worth losing sleep over until one appears.