Red Hat's interim mitigations cover two of the three kernel flaws CISA lists as exploited

AF_ALG is the one to schedule first, because Red Hat offers no easy mitigation for it ^[8]. The bug is a race. A low-privileged local user, or a process inside a container, writes to the same AF_ALG socket concurrently, and the socket's internal state goes inconsistent; the reported outcomes are system crashes or corrupted cryptographic results ^[6]. STAR Labs went further and demonstrated privilege escalation and container escape in a kernelCTF environment ^[7]. The report calls that a test-environment result and says to distinguish it from post-compromise behaviour in real attacks ^[7]. For it to transfer to your fleet, the subsystem has to be enabled and an attacker has to reach the local surface it needs ^[16]. That leaves the vendor patch and a reboot with the updated kernel ^[14].

CVE-2026-53266 is narrower. It needs an environment configured with specific bridge netfilter and ebtables SNAT rules, and the attacker drives the rewriting path for ARP source hardware addresses. A shared page that is not set writable gets modified, and the report ties that to memory corruption, denial of service, and potential local privilege escalation ^[9]. Public analysis infers the privilege-escalation path from similarities to Dirty Pipe, and no public exploit has shown stable privilege escalation ^[10]. The interim step is to remove the SNAT rules that rewrite ARP hardware addresses ^[15].

CVE-2025-39682 is reachable from the network. Specially crafted TLS records go to a network service using kTLS, and because zero-length records sit in the receive queue, different record types get processed by the same recvmsg() ^[11]. Red Hat states remote triggering is possible and has not published the specific impact seen in real attacks ^[12]. The stopgap is to prevent the tls module from loading ^[15].

Two of the three entries therefore have a configuration lever you can pull before a maintenance window, and AF_ALG has none ^[19]. One of the three is reachable from a remote attacker with no local account ^[20]. So the first piece of work is an inventory: which hosts load the tls module, which carry ebtables SNAT rules that rewrite ARP hardware addresses, and which are exposed to unprivileged local or container workloads at all. The report's own criterion for being affected is a vulnerable kernel with the fix not applied plus the matching subsystem and configuration enabled ^[16].

The KEV listing and the public exploit record are two different kinds of evidence. CISA lists all three as known to be exploited without disclosing the paths and outcomes observed in real attacks ^[4]. The threat actor is unidentified, and no published evidence points to phishing for initial access ^[5][18]. The report gives no KEV remediation due date for the three entries ^[21], so what the record supports is a triage order. For end users the report offers nothing beyond letting administrators complete kernel updates and the required reboots on managed devices ^[17].