CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
What it is
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
What to do
Treat this as urgent. Identify every affected system, starting with anything internet-facing, and apply the vendor fix or mitigation within days. If you cannot patch quickly, isolate or disable the affected service and watch for signs of compromise.
- Priority
- Act now: Patch or mitigate internet-facing systems within days.
- Severity (CVSS)
- 9.8 critical
- CISA assessment (SSVC)
- actively exploited; attackers can automate it at scale; total control of the affected system
- Exploit probability (EPSS, 30 days)
- 2.9%, higher than 86% of all CVEs
- Added to CISA KEV
- 18 September 2026
- CISA fix-by date
- 21 September 2026 (US federal agencies; a sensible deadline for everyone)
- Ransomware use
- Not known
- Weakness
- CWE-754
References
- NIST NVD entry
- CISA KEV entry
- git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f
- git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e
- git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9
- git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843
- git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677
- lists.debian.org/debian-lts-announce/2025/10/msg00008.html
Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.