Summary
CISA has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming active exploitation of CVE-2026-0674, CVE-2026-1071, and CVE-2026-3892 in enterprise and cloud environments. All three enable privilege escalation to root on affected Linux systems. CVE-2026-3892 additionally enables container escape, allowing attackers to break out of containerized environments and access the underlying host.
Timeline
| Date | Event |
|---|---|
| Sep 20, 2026 | CISA adds CVE-2026-0674, CVE-2026-1071, and CVE-2026-3892 to KEV catalog; active exploitation confirmed |
What Happened
Linux kernel privilege escalation vulnerabilities allow an attacker who has achieved any level of code execution on a Linux system to escalate to full root access. CVE-2026-3892’s container escape capability is particularly significant for cloud-native infrastructure: an attacker who compromises a containerized workload can escape the container and access the underlying host, potentially reaching other containers and the full network.
CISA’s KEV designation creates a mandatory patch deadline for US federal civilian agencies. Distributions including Red Hat Enterprise Linux, Ubuntu, Debian, and SUSE have released kernel updates addressing these CVEs.
Domain Intelligence
kernel.org — 69.7
kernel.org scores at 69.7. The Linux Kernel Organization is the maintainer of the affected kernel codebase.