No new facts on the bugs — CVE-2025-39682 (the 9.8 kTLS receive-path flaw), CVE-2026-53266, and CVE-2025-39964 have been on the KEV list since Friday, and Red Hat confirmed exploitation over the weekend. What changes today is the clock: BOD 26-04's remediation window closes, so treat this as last call. The fixes are already upstream and in distro updates; the real work is checking that your patch pipeline actually reached the boxes terminating encrypted traffic or running netfilter, not just the fleet's headline kernel version.