CISA ADDS ACTIVELY EXPLOITED LINUX KERNEL TLS VULNERABILITY TO KEV CATALOG: CVE-2025-39682 ELEVATED FOR PRIORITY REMEDIATION

THREAT SUMMARY

Category: Actively Exploited Vulnerability / Linux Kernel / TLS Networking / Kernel Security
Affected Product(s): Linux Kernel
CVE(s): CVE-2025-39682
Primary Risks: Improper handling of exceptional conditions, Linux kernel TLS processing failure, potential confidentiality impact, denial of service, kernel instability, and follow-on compromise depending on attacker access and affected deployment
Threat Status: Active exploitation confirmed by CISA
Affected Environment(s): Linux servers, workstations, cloud systems, virtual machines, appliances, container hosts, and other systems incorporating affected Linux kernel versions
Attack Vector(s): Conflicting assessments exist: Ubuntu and NVD rate the flaw with a local attack vector, while the kernel.org CNA record uses a network attack vector; exploitation involves vulnerable Linux kernel TLS receive processing involving zero-length records and recvmsg
CISA Action: CVE-2025-39682 added to the Known Exploited Vulnerabilities Catalog on September 18, 2026
Required Response: Federal Civilian Executive Branch agencies must follow applicable BOD 26-04 vulnerability-management requirements. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV Catalog vulnerabilities.

---

CISA has added CVE-2025-39682, a Linux Kernel vulnerability involving improper handling of unusual or exceptional conditions, to its Known Exploited Vulnerabilities Catalog after determining that the flaw is being actively exploited.

BOD 26-04 establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies and reinforces the KEV Catalog as a core component of risk-based vulnerability prioritization.

The vulnerability affects the Linux kernel’s TLS receive path and specifically the handling of zero-length records placed on the rx_list.

The upstream CVE record identifies the issue as a defect in the way Linux kernel TLS processing handles specific record conditions during recvmsg() operations.

CISA’s decision to add the vulnerability to KEV means exploitation has moved beyond theoretical analysis.

The flaw is now associated with confirmed active exploitation.

---

Vulnerability Details

CVE-2025-39682 — Linux Kernel Improper Handling of Zero-Length TLS Records

CVE-2025-39682 affects the Linux kernel’s TLS receive path and involves improper handling of an exceptional condition during recvmsg() processing. Each call is expected to process either a sequence of contiguous data records or a single non-data record, but problems can develop when the record type changes and previously decrypted data is placed on the internal rx_list for later handling. In the vulnerable condition, the first record retrieved from that list can be zero length, creating an invalid processing state that the kernel did not properly reject or manage before the fix.

The flaw is classified under CWE-754, which covers improper checking for unusual or exceptional conditions. In practical terms, the kernel encounters an edge case that falls outside the normal processing path and fails to validate it safely. The Linux fix changes how zero-length records are handled so the TLS receive path does not enter the faulty condition. Because this code executes inside privileged kernel space, an error that appears narrow at the record-processing level can have broader consequences for system confidentiality, stability, and availability.

Ubuntu and NVD assess CVE-2025-39682 at CVSS 3.1 7.1 High, with a local attack vector, low attack complexity, low privileges required, and no user interaction. The kernel.org CNA record carries a separate CVSS 3.1 assessment of 9.8 Critical, using a network attack vector with no privileges required and no user interaction. Under the Ubuntu/NVD assessment, the local attack vector means an attacker generally needs some existing foothold on the system rather than direct unauthenticated access from the internet, but that does not substantially reduce the operational risk once a host has already been compromised. Attackers can chain kernel flaws with stolen credentials, exploited services, malicious code execution, or compromised applications, using the kernel vulnerability as a second-stage technique to deepen access, destabilize the host, or increase control over the system.

---

Affected Linux Versions

The CVE record shows that the issue affected multiple Linux kernel branches and was later corrected across supported stable releases.

The upstream record identifies affected versions beginning with Linux 6.0 and lists corrected builds across several maintained kernel branches, including:

• Linux 6.1.149 and later within the 6.1 branch.
• Linux 6.6.103 and later within the 6.6 branch.
• Linux 6.12.44 and later within the 6.12 branch.
• Linux 6.16.4 and later within the 6.16 branch.
• Linux 6.17 as unaffected.

Organizations should not use upstream kernel version numbers alone to determine exposure.

Major Linux distributions frequently backport security fixes into older kernel versions without changing the upstream version number in an obvious way.

Administrators should therefore rely on their Linux distribution, cloud provider, appliance vendor, or hardware vendor security advisory when determining whether a system is vulnerable.

Ubuntu, for example, has already released fixed kernel packages across multiple supported environments, including Ubuntu 24.04 LTS and several cloud-specific kernel variants.

---

Operational Impact

CVE-2025-39682 affects the Linux kernel rather than a conventional user-space application.

That changes the risk profile.

• The vulnerable code exists inside the operating system’s TLS networking implementation.
• Successful exploitation can affect kernel stability and system availability.
• Ubuntu’s severity assessment identifies potential confidentiality and availability impact.
• Systems hosting multiple services may experience broader consequences if the underlying kernel becomes unstable or compromised.
• Virtualization hosts and container hosts deserve additional scrutiny because multiple workloads can depend on a single underlying kernel.
• Cloud systems using affected kernel packages may inherit exposure even when individual applications are fully patched.
• Embedded appliances and security products built on Linux may also be affected if vendors incorporated vulnerable kernel versions.
• Organizations that monitor only application CVEs may overlook kernel exposure.

CISA’s active-exploitation designation should move this vulnerability out of normal maintenance cycles and into prioritized remediation.

---

Federal Response

The September 18 addition falls under Binding Operational Directive 26-04: Prioritizing Security Updates Based on Risk.

BOD 26-04 establishes vulnerability-management requirements for Federal Civilian Executive Branch agencies and reinforces the KEV Catalog as a core mechanism for prioritizing vulnerabilities that attackers are actively exploiting.

Under the directive, agencies must prioritize rapid remediation of high-risk KEV vulnerabilities on publicly exposed assets where exploitation grants total control of the asset, while lower-risk vulnerabilities may receive deferred action.

That requirement is especially important for kernel vulnerabilities.

Installing a patched kernel prevents future exploitation of the corrected flaw.

It does not prove that the system was not previously compromised.

BOD 26-04 also establishes expectations for determining when agencies must check whether threat actors compromised a system before remediation was applied.

---

KEV

CISA adds vulnerabilities to the Known Exploited Vulnerabilities Catalog when they meet defined criteria that include:

• Assignment of a valid CVE identifier.
• Evidence of exploitation.
• Availability of clear remediation or mitigation guidance.

CVE-2025-39682 now satisfies those requirements.

The vulnerability was originally published in September 2025 and was updated by the CVE authority in August 2026 before being added to KEV on September 18, 2026.

The time between initial disclosure and KEV inclusion demonstrates an important vulnerability-management principle.

A flaw can exist publicly for months before evidence of active exploitation becomes strong enough to trigger KEV status.

Organizations that deferred remediation because exploitation was not initially confirmed may now need to reassess that decision.

KEV status changes the operational priority.

---

Defensive Guidance

Organizations operating Linux infrastructure should immediately identify whether affected kernels or vendor packages remain deployed.

Priority actions should include:

• Inventory Linux servers, workstations, cloud workloads, virtual machines, appliances, hypervisors, and container hosts.
• Check vendor advisories specifically for CVE-2025-39682.
• Apply distribution-approved kernel security updates.
• Reboot systems where required so the patched kernel is actually loaded.
• Verify the running kernel version after reboot.
• Do not rely solely on package installation status.
• Review systems using Linux kernel TLS functionality for exposure.
• Examine kernel logs for unexplained TLS processing errors, crashes, or instability.
• Investigate suspicious local privilege activity or unusual process behavior on vulnerable hosts.
• Review authentication records for accounts that could have provided attackers with initial local access.
• Examine container and virtualization hosts closely because multiple workloads may depend on the same kernel.
• Review cloud images and long-running instances that may have missed prior kernel updates.
• Identify appliances that embed Linux even when administrators do not normally interact with the operating system directly.
• Preserve relevant forensic evidence if exploitation is suspected.
• Rebuild systems from trusted images where kernel compromise cannot be ruled out.

Ubuntu users should compare installed packages against the fixed versions provided through their applicable security updates. Ubuntu 24.04 LTS standard kernels were corrected in the 6.8.0-86.87 package line, with additional fixes released for cloud and specialized kernel variants.

---

30-Day Outlook

The risk associated with CVE-2025-39682 is likely to remain elevated now that CISA has publicly confirmed exploitation.

Organizations should expect:

• Increased defensive scanning for vulnerable Linux kernels.
• Wider attacker awareness of the flaw after KEV publication.
• Additional exploitation research and proof-of-concept analysis.
• Greater interest in combining the vulnerability with other initial-access techniques.
• Targeting of systems where attackers already possess limited local access.
• Continued vendor updates for downstream Linux products and appliances.
• Expanded detection guidance for suspicious kernel-level activity.
• Increased scrutiny of cloud, virtualization, and container-host environments.
• Continued emphasis on verifying that patched kernels are actually running after reboot.
• Retrospective compromise assessment for systems that remained vulnerable before remediation.

The local attack-vector assessment used by Ubuntu and NVD should not be used as justification for delay, particularly because the kernel.org CNA record separately assigns a network attack vector.

Many successful intrusions occur in stages.

An attacker may first compromise an exposed application or steal credentials.

A kernel vulnerability can then become the mechanism used to deepen access or destabilize the host.

That is why KEV status matters even when different authorities assess the exploitation path differently.

---

TRJ Verdict

CVE-2025-39682 is another reminder that small edge-case failures inside kernel networking code can become serious operational threats once attackers begin exploiting them.

The vulnerability is rooted in the Linux kernel’s handling of zero-length TLS records during recvmsg() processing.

On paper, that may appear narrow.

In practice, it affects privileged operating-system code and carries potential confidentiality and availability consequences.

The strongest signal is CISA’s decision to place the vulnerability in the KEV Catalog.

That confirms exploitation is occurring outside controlled research environments.

Organizations running affected Linux kernels should immediately identify exposed systems, apply vendor-approved fixes, reboot into the corrected kernel, and determine whether any vulnerable hosts show evidence of prior compromise.

For CVE-2025-39682, remediation should not stop at installing a kernel update.

Defenders also need to know whether the vulnerable system was reached before the fix was applied.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---