Cyber & AI intelligence
Wasteland.
Briefs indexed2769
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2025-39682 2026-09-18

CVE-2025-39682: Linux Kernel TLS Zero-Length Record Flaw Added to CISA KEV

"CISA added CVE-2025-39682, an improper check for unusual or exceptional conditions in the Linux kernel's TLS receive path, to the Known Exploited Vulnerabilities catalog on 2026-09-18 with a due date of 2026-09-21."

CISA added CVE-2025-39682, an improper check for unusual or exceptional conditions in the Linux kernel's TLS receive path, to the Known Exploited Vulnerabilities catalog on 2026-09-18 with a due date of 2026-09-21.

What Is It

The flaw lives in net/tls/tls_sw.c, the kernel's software TLS receive path. Each recvmsg() call is supposed to process either a series of back-to-back DATA records or a single non-DATA record. When the record type changes mid-loop and the record has already been decrypted, common under TLS 1.3, where the type is unknown until decryption, the kernel queues the pending skb to rx_list for the next recvmsg() to pick up. That queuing is impossible after a zero-copy decrypt, because the plaintext went straight to the userspace buffer and there is no skb to queue. Only DATA records are permitted zero-copy, so the mismatch should never occur. The case the code missed: the initial record comes from rx_list and is zero length. A zero-length record pulled from rx_list skips the record-type handling entirely, and the TLS records that follow get processed under the wrong zero-copy and queuing assumptions.

CWE-754 (Improper Check for Unusual or Exceptional Conditions). NVD's primary CVSS 3.1 score is 7.1 HIGH (AV:L/AC:L/PR:L/UI:N/C:H/I:N/A:H); a secondary score from the CNA rates it 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H).

Why It Matters

CISA's SSVC scoring says the flaw is being exploited right now, that an attack can be automated, and that a successful attack gives an attacker full control of the affected system. The KEV entry says forensic triage is required. Whether ransomware crews are using it is listed as Unknown.

Kernel TLS is an optional feature; it has to be compiled in and explicitly turned on by an application via setsockopt(), and it is off on an ordinary Linux desktop or web server. Where it is in use, though, it tends to be on servers and appliances that hand TLS encryption to the kernel for speed, which means the buggy code is chewing on data sent by whoever is on the other end of the connection. So the number of affected machines is small, but they skew toward the ones taking connections from outside; the question to answer is which of your systems actually have kTLS switched on.

What's Vulnerable

The upstream advisory identifies Linux kernel 6.0 and later, with fixes in 6.1.149, 6.6.103, 6.12.44, 6.16.4, and 6.17. That range describes mainline only. Distribution kernels carry backported TLS code, so older-numbered kernels can still be affected: Debian Linux 11.0 is listed as affected despite shipping a 5.10-based kernel, as is Siemens SIMATIC CN 4100 before V5.0. Do not treat "below 6.0" as a safe floor; check the vendor advisory for the specific kernel build in use. CISA notes impacted products may be end-of-life or end-of-service, in which case users should stop using them or move to a supported version.

Patch Status

Fixed upstream; five stable-tree commits are referenced. CISA's required action: apply mitigations per vendor instructions in compliance with BOD 26-04 and the Forensics Triage Requirements, follow BOD 26-04 cloud-service guidance where applicable, or stop using the product if no mitigation is available. System owners must also check whether each affected machine is reachable from the internet.

Sources