What it is
CVE-2025-39682 is an unauthenticated tls: fix handling of zero-length records on the rx_list affecting Linux Linux. In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length...
Vulnerability report
Exploited in the wild
Confirmed confidence
In CISA KEV
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
Linux / Linux · affected before V5.0
- Severity
- CVSS 9.8 · Critical
- Confidence
- Confirmed
- Exploit status
- Exploited in the wild
- EPSS
- 1.2%
- First observed
- —
- Last observed
- —
Decision summary
What security teams need to know first
Direct answers before the deeper technical record.
Is it exploited?
Yes. Previdian tracks this CVE as a known exploited vulnerability. Confidence is confirmed. Listed in CISA KEV. Also confirmed by third-party sources.
Who is affected?
Linux / Linux affected before v5.0.
What should we do?
Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Overview
tls: fix handling of zero-length records on the rx_list
In the Linux kernel, the following vulnerability has been resolved:
tls: fix handling of zero-length records on the rx_list
Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record
If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there.
Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length).
Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.
Vendor
Product
Affected
Status
Siemens
Affected
SIMATIC CN 4100
Before V5.0
Affected
Linux
Affected
Linux
Before 2902c3ebcca52ca845c03182000e8d71d3a5196f
Before c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677
Before 3439c15ae91a517cf3c650ea15a8987699416ad9
Before 29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e
Before 62708b9452f8eb77513115b17c4f8d1a22ebf843
6.0
Affected
Linux
Unaffected
Linux
Before 6.0
Through 6.1.*
Through 6.6.*
Through 6.12.*
Through 6.16.*
Through *
Unaffected
- Published
- 05 Sep 2025
- Exploitation Reported
- 18 Sep 2026
- Attack vector
- Remote
- Complexity
- Low
- Privileges
- None
- User interaction
- None
Tags
linux
cisa
CVE References
- CVE Record CVE.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2025-39682
- git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a... git.kernel.org · CVE Record https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f
- git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c... git.kernel.org · CVE Record https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677
- git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a89876994... git.kernel.org · CVE Record https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9
- git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a... git.kernel.org · CVE Record https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e
- git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22e... git.kernel.org · CVE Record https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843
Exploitation evidence
Why Previdian marks this CVE as exploited
Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.
Exploited in the wild
CISA
A trusted third party reported exploitation.
Known exploited vulnerability sources
Per-source evidence links for KEV attestations are available through the Previdian Pro API.
Learn about Pro API access| Source | Added |
|---|---|
| CISA First | 2026-09-18 19:20 UTC |
| CVE | 2026-09-18 19:40 UTC |
| The Hacker News | 2026-09-19 00:00 UTC |
| TheHackerNews | 2026-09-19 06:24 UTC |
Detection
Operational artifacts and observed signals
Make the evidence actionable in scanner, SOC, and edge-control workflows.
Observed signals
- Request targets
- User-Agents
- Callback hosts
- 0
- 0
- 0
Request targets and User-Agents available in Pro. Callback host details available in Enterprise.
Scanner coverage
No scanner integrations recorded yet.
Virtual patch status
No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.
Learn about virtual patches →No detection artifacts or sensor request patterns are available for this CVE yet.
Check back as sensor telemetry and scanner integrations are updated.
Risk and context
Severity, weaknesses, and research context
CVSS v3.1
9.8
Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.2%
Recent mention · Security Affairs
U.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added [1, 2] the following vulnerabilities to its Known Exploited...
Read full advisoryAll Mentions
Recent mention · Security Affairs
U.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs · 20 Sep 2026
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added [1, 2] the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are detailed descriptions of the flaws: At the time of this writing, there are currently no details on how the […]
Recent mention · TheHackerNews
CISA Flags Three Linux Kernel Vulnerabilities Exploited in the WildTheHackerNews · 19 Sep 2026
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2025-39682 (CVSS score: 9.8) - An improper check for unusual or exceptional conditions vulnerability in the TLS receive path
Timeline
From disclosure to observed exploitation
-
06:24 UTC
KEV confirmed by TheHackerNews
Exploitation attested by an external source
-
00:00 UTC
KEV confirmed by The Hacker News
Exploitation attested by an external source
-
19:40 UTC
KEV confirmed by CVE
Exploitation attested by an external source
-
19:20 UTC
Added to CISA KEV
Listed in the CISA Known Exploited Vulnerabilities catalog
-
17:20 UTC
CVE published
Vulnerability disclosed publicly
-
07:20 UTC
CVE ID reserved
Identifier reserved by the CNA
Pro API
Automate this intelligence
Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.
- Evidence confidence and provenance
- First-party sensor telemetry
- PoC and scanner references
- Affected versions and enrichment
- Automation-ready JSON delivery
GET /api/v2/pro/kevs/CVE-2025-39682
Free JSON includes basic KEV fields{
"cve_id": "CVE-2025-39682",
"confidence": "Confirmed",
"cvss_score": 9.8,
"cvss_estimated": false,
"epss_score": 0.012,
"exploit_status": {
"exploited_in_the_wild": true,
"active_exploitation_observed": false
},
"sensor_telemetry": { "attempts": 0, "sensors": 0 }
}