Linux Kernel Vulnerability Impacting TLS Record Processing
CVE-2025-39682

9.8CRITICAL

Key Information:

Vendor: Linux
Status: Linux
Vendor: CVE Published:; 5 September 2025

Badges

👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2025-39682?

In the Linux Kernel, a vulnerability related to the processing of TLS records has emerged. When handling incoming messages via the recvmsg() function, the system must properly manage both DATA and non-DATA records to avoid processing errors. An incorrect handling of zero-length records may result in a failure to queue records appropriately when transitioning between different record types. Specifically, if the initial record is derived from the rx_list and is zero-length, the established processing loop could break down, leading to potential security risks such as improper decryption or data corruption. This issue highlights the importance of robust TLS record handling to safeguard data integrity and security in network communications.

CISA has reported CVE-2025-39682

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2025-39682 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.