VulnTideExploited vulnerabilities, by vendor. Data as of .
Known exploitedIn CISA's KEV catalog since Ransomware use: unknown
Linux Kernel

CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

Is it exploited?

Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 378 days after the CVE record was published.

How likely is exploitation in the next 30 days?
3.3%

EPSS score, percentile 88.3 of all scored records

How severe?
9.8 Critical

CVSS v3.1 base score, given by the CNA

What should I do?

CISA deadline . Apply mitigations in accordance with vendor instructions … Full text

The CVE record links no vendor advisory, patch or mitigation.

Which versions are affected?

Affected

  • 6.0

Unaffected before 6.0; 6.1.149; 6.6.103; 6.12.44; 6.16.4; 6.17

Versions by product

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

What to do

Required action, set by CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CISA due date for this action: .

Advisories and patches

The CVE record links no vendor advisory, patch or mitigation.

Linked from CISA's catalog entry

Affected products and versions

As listed in the CVE record.

Linux Linux
StatusVersions
Affectedfrom 84c61fe1a75b to before 2902c3ebcca5
Affectedfrom 84c61fe1a75b to before c09dd3773b59
Affectedfrom 84c61fe1a75b to before 3439c15ae91a
Affectedfrom 84c61fe1a75b to before 29c0ce3c8cdb
Affectedfrom 84c61fe1a75b to before 62708b9452f8

Versions not listed are: unaffected.

Linux Linux
StatusVersions
Affected6.0
Unaffectedbefore 6.0
Unaffected6.1.149
Unaffected6.6.103
Unaffected6.12.44
Unaffected6.16.4
Unaffected6.17

Versions not listed are: affected.

Versions the record lists as unaffected: 6.1.149, 6.6.103, 6.12.44, 6.16.4, 6.17.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

About this vulnerability

Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

Summary: CISA's KEV catalog, as of .

  • CISA added CVE-2025-39682 to its Known Exploited Vulnerabilities (KEV) catalog on 18 Sep 2026.
  • CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
  • The due date CISA sets for the required action is 21 Sep 2026.
  • The CVE record was published on 5 Sep 2025, 378 days before it was added to KEV.
  • The CVE record carries a CVSS v3.1 base score of 9.8 (Critical), given by its CNA.
  • FIRST's EPSS model puts the probability of exploitation in the next 30 days at 3.3% (percentile 88.3), as of 28 Oct 2026.
  • CISA's SSVC assessment in the CVE record: exploitation active, automatable yes, technical impact total.

Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.

Description

tls: fix handling of zero-length records on the rx_list

In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.

Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.

Weakness

  • CWE-754: Improper Check for Unusual or Exceptional Conditions

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.

Timeline

DateEvent
CVE record published
Added to CISA KEV
CISA due date for the required action
CVE record last updated

References

More exploited Linux vulnerabilities

  • CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability (added )
  • CVE-2025-39964: Linux Kernel Race Condition Vulnerability (added )
  • CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability (added )
  • CVE-2026-53362: Linux Kernel Unspecified Vulnerability (added )
  • CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability (added )
  • CVE-2022-0492: Linux Kernel Improper Authentication Vulnerability (added )