Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2025-39682 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2025 |
| Date Published | 2026-09-18 |
| Vendor | Linux |
| Product | Kernel |
| CVSS Score | 9.8 (critical) |
| EPSS Score | 0.5% (percentile: 42%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-21 |
Vulnerability Description
Source: CISA KEV
The Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path.
The mechanism: a zero-length record retrieved from the rx_list bypasses the intended record-type handling in recvmsg(). As a consequence, subsequent TLS records may be processed using incorrect zero-copy and queuing assumptions.
The heart of the problem is an edge case the code did not anticipate: an empty record. The impact is not a single misread, but a violation of the assumptions applied to the records that follow — a state in which the kernel processes further traffic against an outdated picture of the situation.
A separate warning from the CISA entry: some affected releases may already be end-of-life (EoL) or end-of-service (EoS). For those systems a fix may never arrive, and the recommendation becomes discontinuing use or migrating to a supported version. That turns the task from “apply an update” into “plan a replacement”.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects systems based on the Linux Kernel — the CPE entry covers both linux:linux_kernel and the Debian distribution.
Because the flaw sits in kTLS handling, review first the systems that terminate TLS in the kernel: proxy servers, load balancers, and services carrying high volumes of encrypted traffic. Separately, list machines running end-of-life kernels — an update may not be available for them, and a migration decision needs time and a maintenance window, so the sooner it enters the plan, the better.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
