A four-year-old Linux kernel flaw enters KEV in 2026 — the catalog is not a list of new vulnerabilities

1Listing turns on exploitation, not novelty

The CISA Known Exploited Vulnerabilities catalog is often treated as a list of the most dangerous vulnerabilities right now. But the condition for listing is not novelty; it is confirmation that exploitation has actually occurred. This entry makes that plain. The CVE number was assigned in 2022 and the catalog addition is dated 2026-08-26 — roughly four years apart.

2The year assigned against the year listed

The assignment years peak in 2021 with long tails on either side, reaching back to entries assigned in 2002 — vulnerabilities more than two decades old that were listed once exploitation was confirmed. On the addition side, 2022 stands out at 555, which reads as the catalog start-up period when known exploitation cases were registered together.

3Where privilege escalation sits

This entry concerns a local user gaining privileged access or causing denial of service. It is not a route for breaking in from outside but the type used to raise privileges by someone already inside. The reason it does not work to seal only the first stage of an intrusion is that second-stage tools like this persist for years.

Kernel vulnerabilities reach broadly, and Kernel appears among the leading product names in the records this site holds, with 31.

4A 14-day grace period

The due date is 14 days after the addition. Across the 1,687 records this site holds as of 2026-09-02, grace periods have a median of 21 days, a minimum of 1 and a maximum of 184, so this is somewhat on the short side. The required action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use. Verify applicability with official vendor information and your own environment.