{"id":"CVE-2025-39682","kind":"vulnerability","aliases":["CVE-2025-39682"],"related":[],"title":"In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntls: fix handling of zero-length records on the rx_list\n\nEach recvmsg() call must process either\n - only contiguous DATA records (any number of them)\n - one non-DATA record\n\nIf the next record has different type than what has already been\nprocessed we break out of the main processing loop. If the record\nhas already been decrypted (which may be the case for TLS 1.3 where\nwe don't know type until decryption) we queue the pending record\nto the rx_list. Next recvmsg() will pick it up from there.\n\nQueuing the skb to rx_list after zero-copy decrypt is not possible,\nsince in that case we decrypted directly to the user space buffer,\nand we don't have an skb to queue (darg.skb points to the ciphertext\nskb for access to metadata like length).\n\nOnly data records are allowed zero-copy, and we break the processing\nloop after each non-data record. So we should never zero-copy and\nthen find out that the record type has changed. The corner case\nwe missed is when the initial record comes from rx_list, and it's\nzero length.","summary":"Linux kernel kTLS (net/tls/tls_sw.c) bug: when a zero-length TLS 1.3 record is the first record taken from rx_list, recvmsg() mishandles record-type changes and the zero-copy path, so a later record is queued or processed wrongly. NVD rates it local, low-privilege, with high confidentiality and availability impact (memory disclosure or DoS). It is in CISA KEV (added 2026-09-18). Affected: kernels 6.0 up to the fixed stable releases. Only systems that use kernel TLS receive (the tls module with sockets set to the tls ULP) are reachable.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-09-18T00:00:00+00:00","products":[{"name":"Linux Kernel","fixed":["6.1.149","6.6.103","6.12.44","6.16.4","6.17-rc3"],"affected":">= 6.0, < 6.1.149; >= 6.2, < 6.6.103; >= 6.7, < 6.12.44; >= 6.13, < 6.16.4; 6.17-rc1, 6.17-rc2","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.1.149"],"affected":">= 6.0, < 6.1.149","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.6.103"],"affected":">= 6.2, < 6.6.103","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.12.44"],"affected":">= 6.7, < 6.12.44","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.16.4"],"affected":">= 6.13, < 6.16.4","ecosystem":"vendor"},{"name":"linux kernel","fixed":[],"affected":"= 6.17","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"siemens simatic cn 4100 firmware","fixed":["5.0"],"affected":"< 5.0","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kernel","ktls","linux","local","self-hosted","tls"],"not_affected_if":["kernel-older-than-6.0","ktls-not-enabled","managed-hosting","tls-module-not-loaded"],"how_to_check":"Run 'uname -r' and compare with the fixed versions. Then check whether kTLS is in use: 'lsmod | grep tls', and 'cat /proc/net/tls_stat' (non-zero TlsRxSw/TlsRxDevice counters mean kTLS receive is active). If the tls module is not loaded and no app enables it, the code path is not reachable. Distro kernels backport fixes, so check your vendor's CVE tracker (Ubuntu says Jammy and older are not affected).","fix":"Update to 6.1.149, 6.6.103, 6.12.44, 6.16.4 or 6.17 and later (fix in 6.17-rc3). On a distro kernel, install the vendor kernel update that lists CVE-2025-39682 and reboot. Interim mitigation if you cannot patch: keep the tls module from loading (blacklist it) if nothing needs kTLS; this is my inference, not a vendor statement.","status":"open","published_at":"2025-09-05T18:15:44+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:29:49+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-10-23T20:29:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","summary":"A flaw in the Linux kernel's TLS receive path lets a zero-length TLS record bypass record-type handling in recvmsg(), so later TLS records are processed with wrong zero-copy and queuing assumptions. CISA lists it as actively exploited, and the sources do not describe the exact attacker capability beyond that.","category":"infrastructure","who_cares":["linux","kernel","tls","self-hosted"],"confidence":0.5,"analyst_note":"Find the fixed kernel versions and affected ranges from the kernel.org CVE entry or vendor advisory for CVE-2025-39682, and check whether kTLS receive is reachable by default.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"severity_if_unknown":"high"},"cost_usd":0.000376,"input_tokens":2315,"output_tokens":288,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed kernel versions and affected ranges from the kernel.org CVE entry or vendor advisory for CVE-2025-39682, and check whether kTLS receive is reachable by default.","search":"'-09':122B '-18':123B '-2025':20A,23A '-39682':21A,24A '1.3':67B,228C '2026':121B '4100':42A '6.0':126B 'access':296C 'add':120B 'affect':124B 'allow':305C 'alreadi':203C,218C 'avail':109B 'break':207C,311C 'buffer':279C 'bug':60B 'call':176C 'case':225C,271C,340C 'chang':82B,337C 'ciphertext':293C 'cisa':118B 'cn':41A 'come':348C 'confidenti':107B 'contigu':181C 'copi':87B,263C,308C,327C 'corner':339C 'cve':19A,22A 'darg.skb':289C 'data':182C,191C,302C,319C 'debian':37A 'decrypt':220C,236C,264C,273C 'differ':198C 'direct':274C 'disclosur':112B 'dos':114B 'either':179C 'exploit':46B 'find':330C 'firmware':43A 'first':71B 'fix':12A,130B,163C 'follow':6A,157C 'handl':13A,164C 'high':106B 'host':54B 'impact':110B 'infrastructur':47B 'initi':346C 'kernel':4A,26A,28A,30A,32A,34A,36A,45A,48B,57B,125B,137B,155C 'kev':119B 'know':233C 'ktls':49B,58B 'later':91B 'length':17A,65B,168C,300C,356C 'like':299C 'linux':3A,25A,27A,29A,31A,33A,35A,38A,44A,50B,56B,154C 'list':76B,173C,245C,259C,351C 'local':51B,101B 'loop':213C,314C 'low':103B 'low-privileg':102B 'main':211C 'may':222C 'memori':111B 'metadata':298C 'mishandl':78B 'miss':342C 'modul':142B 'must':177C 'net/tls/tls_sw.c':59B 'never':324C 'next':195C,246C 'non':190C,318C 'non-data':189C,317C 'number':185C 'nvd':98B 'one':188C 'path':88B 'pend':240C 'pick':249C 'point':290C 'possibl':267C 'privileg':104B 'process':96B,178C,205C,212C,313C 'queu':94B,254C 'queue':238C,288C 'rate':99B 'reachabl':151B 'receiv':139B 'record':18A,68B,72B,80B,92B,169C,183C,192C,196C,216C,241C,303C,320C,334C,347C 'record-typ':79B 'recvmsg':77B,175C,247C 'releas':132B 'resolv':10A,161C 'rx':75B,172C,244C,258C,350C 'self':53B 'self-host':52B 'set':145B 'siemens':39A 'simatic':40A 'sinc':268C 'skb':256C,286C,294C 'socket':144B 'space':278C 'stabl':131B 'system':134B 'taken':73B 'tls':11A,55B,66B,138B,141B,148B,162C,227C 'type':81B,199C,234C,335C 'ulp':149B 'use':136B 'user':277C 'vulner':7A,158C 'wrong':97B 'zero':16A,64B,86B,167C,262C,307C,326C,355C 'zero-copi':85B,261C,306C,325C 'zero-length':15A,63B,166C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-09-05T18:15:44+00:00","kev":{"dateAdded":"2026-09-18","dueDate":"2026-09-21","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-39682","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-39682","severity":null,"published_at":"2026-09-18T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T20:35:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2025-39682:115","url":null,"severity":null,"published_at":"2026-10-23T21:37:11+00:00","modified_at":"2026-10-23T21:37:11+00:00","first_seen_at":"2026-10-23T21:37:11+00:00","fetched_at":"2026-10-23T21:37:11+00:00","note":"Kernel CNA advisory (openwall linux-cve-announce) gives affected/fixed; KEV added 2026-09-18, no exploitation details or public PoC found. NVD CVSS 3.1 7.1 (AV:L, PR:L); press reports of 9.8 conflict with NVD. Bug introduced in 6.0 (84c61fe1a75b). Default reachability of kTLS rx is from general kernel knowledge, not a read source."},{"source":"nvd","external_id":"CVE-2025-39682","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39682","severity":null,"published_at":"2025-09-05T18:15:44+00:00","modified_at":"2026-10-19T21:10:00+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1140,"url":"https://lists.openwall.net/linux-cve-announce/2025/09/05/31","title":"linux-cve-announce: CVE-2025-39682 (kernel CNA)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1141,"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-39682","title":"NVD CVE-2025-39682","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1142,"url":"https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-one-known-exploited-vulnerability-catalog","title":"CISA adds CVE-2025-39682 to KEV (2026-09-18)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":1143,"url":"https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843","title":"Upstream fix commit (6.17-rc3)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1144,"url":"https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html","title":"The Hacker News: CISA flags three Linux kernel vulnerabilities","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}