CVE-2025-39682

CISA KEV

ACT NOW Priority: 0.00 BB Relevance: 1/100

Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

CISA Known Exploited Vulnerability

Vendor / Product Linux — Kernel

Date Added 2026-09-18

Remediation Due 2026-09-21

This vulnerability affects an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: ; https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f; https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677; https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9; https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e; https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-39682

Weakness Classification (1)

CWE-754

Affected Software (8)

Vendor	Product	Version
debian	debian_linux	11.0
linux	linux_kernel	6.0 – 6.1.149
linux	linux_kernel	6.2 – 6.6.103
linux	linux_kernel	6.7 – 6.12.44
linux	linux_kernel	6.13 – 6.16.4
linux	linux_kernel	6.17
linux	linux_kernel	6.17
siemens	simatic_cn_4100_firmware	< 5.0