CISA Adds Three Linux Kernel Flaws to Known Exploited Vulnerabilities Catalog

WASHINGTON — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three critical vulnerabilities in the Linux kernel to its Known Exploited Vulnerabilities catalog on Sunday, September 20, 2026. The move mandates that federal agencies patch their systems immediately to defend against active attacks exploiting these flaws.

The announcement marks a significant escalation in the agency's efforts to secure government infrastructure against known threats. By placing these specific defects on the catalog, CISA has triggered strict compliance requirements for all federal civilian agencies. Under existing directives, agencies must remediate vulnerabilities listed in the catalog within 14 days of their inclusion, or provide a detailed plan for mitigation if immediate patching is not feasible.

The three newly listed flaws affect the core operating system software that powers a vast array of government servers, cloud environments, and network devices. The Linux kernel serves as the foundational layer for many critical systems across the federal sector. Security officials indicated that threat actors have already demonstrated active exploitation of these weaknesses in the wild, posing an immediate risk to national security infrastructure.

The addition of these vulnerabilities to the catalog is part of a broader strategy to reduce the attack surface available to adversaries. CISA has increasingly relied on the Known Exploited Vulnerabilities list as a primary tool for coordinating defensive actions across the federal government. The agency's leadership emphasized that the inclusion of these kernel flaws reflects intelligence indicating that attackers are actively scanning for and targeting unpatched systems.

Federal agencies are now required to inventory their Linux-based assets and apply vendor-recommended patches or workarounds without delay. Failure to comply with the catalog requirements can result in heightened scrutiny from oversight bodies and potential restrictions on agency operations. The directive applies to all executive branch departments, independent agencies, and government contractors managing federal IT systems.

While the specific technical details of how each vulnerability is being exploited remain under review by security researchers, the urgency of the situation has prompted immediate action across the sector. System administrators at various levels of government are currently assessing their exposure and initiating patch management cycles to address the identified risks.

The inclusion of these three flaws raises questions about the scope of previous breaches that may have occurred before the catalog update. Security experts are monitoring whether any federal systems were compromised in the window between the discovery of the exploits and their official listing. As agencies rush to secure their networks, the focus remains on ensuring no active intrusions go undetected while remediation efforts are underway.