CVE-2025-39682 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: MEDIUM

Exploitation Method: DIRECT_NETWORK

CVE Published: 2025-09-05

Added to CISA KEV: 2026-09-18 378 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
PATCH IMMEDIATELY: Update Linux kernel to 6.1.149+, 6.6.103+, 6.12.44+, 6.16.4+, or 6.17+ depending on your distribution. Apply distribution-specific security updates (Debian, Ubuntu, RHEL, Amazon Linux advisories).
IDENTIFY EXPOSURE: Audit which servers run OpenSSL 3.x+ with kTLS enabled. Check with: 'openssl version' and verify if kTLS is active via application configuration or 'ss -ti' on active TLS sockets.
TEMPORARY MITIGATION: If patching is not immediately possible and kTLS is not required, disable kTLS offload in your TLS library configuration (e.g., set OPENSSL_NO_KTLS or equivalent) or unload the tls kernel module where feasible.
MONITOR: Watch for unexpected kernel panics, OOM events, or slab corruption kernel logs (dmesg) on TLS-serving hosts. These may indicate exploitation attempts.
NETWORK CONTROLS: Consider TLS inspection or rate-limiting at load balancers to detect/block anomalous TLS record sequences (zero-length content-type-mixed records) as a compensating control.
Siemens SIMATIC CN 4100 users: Apply Siemens patch to V5.0 or later per SSA-032379. Isolate OT devices from direct internet exposure if patching is delayed.
PATCH PRIORITY: CRITICAL for internet-facing Linux TLS servers running OpenSSL 3.x. HIGH for all other Linux kernel deployments in the affected version range regardless of kTLS status.

🔍 Web Intelligence (Kagi · 2026-09-18)

Summary

CVE-2025-39682 is a security vulnerability residing in the Linux kernel's implementation of Transport Layer Security (kTLS), specifically involving a logic flaw in the handling of zero-length records on the receive list (`rx_list`). This issue arises because the receive path improperly manages these records during the `recvmsg` process, which can lead to memory corruption or unstable kernel states. It is a significant concern because it affects a core kernel component, potentially allowing an attacker to trigger kernel-level exploits if they can interact with the affected TLS functionality.

Exploitation

Active Exploitation: While used in security research contexts (such as kernelCTF mitigation instances, specifically identified as `exp398` and `exp403`), there is no widespread report of it being actively exploited by malicious actors in the wild as of September 2026 ^[1].
Threat Actors/Campaigns: No specific threat actors or ransomware campaigns have been publicly linked to the exploitation of this vulnerability.
Proof-of-Concept/Exploit: Publicly available proof-of-concept (PoC) exploit code exists, particularly associated with kernel research and 1-day exploit development ^[1]^[5].
Attack Prerequisites: Exploitation typically requires the ability to trigger the specific logic error within the kTLS receive path. It is generally considered a local vulnerability, requiring the attacker to have some form of access to the system to initiate the kernel-level interaction, though its severity depends on the exposure of the kTLS interface.

Affected Products & Patches

Affected Versions: The vulnerability affects various versions of the Linux kernel, with some analysis indicating impact on versions from 5.1 prior to patched releases like 5.4.270 and 5.10.211 ^[2].
Patch Availability: Patches have been released by the Linux kernel community to correct the handling of zero-length records in the `rx_list`. Users should check their specific distribution’s security advisories (e.g., Debian, Ubuntu, Red Hat, Amazon Linux) for the inclusion of these fixes in their respective kernel packages ^[3]^[4].
Mitigations: The primary mitigation is to update the kernel to a version containing the official upstream fix. There are no prominent workarounds that do not involve upgrading the affected software.

Impact

Access/Capability: Successful exploitation of this flaw can lead to kernel-level memory corruption, which may result in a denial-of-service (kernel panic) or potentially facilitate local privilege escalation depending on the environment and the effectiveness of the exploit.
Business Risk: For internet-facing deployments, any vulnerability that risks kernel stability or provides a vector for privilege escalation is critical. If an attacker gains local access or can influence the traffic processed by the kTLS subsystem, they could leverage this vulnerability to compromise the integrity or availability of the host system.

Sources

khoatran107/cve-2025-39682: A variant of CVE-2024-58239
CVE-2025-39682 exploit on kernelCTF mitigation instance ・ is a variant of ・ fix handling of zero-length records on. This CVE was used in exp398 and and exp ... CVE-2025-39682 exploit on kernelCTF mitigation instance This is also my first (? idk, this is a variant of CVE-2024-58239) 1-day exploit. Pa…
CVE-2024-58239 & CVE-2025-39682 1-day analysis
2025-39682 Vulnerability Overview. Severity High Affected Versions From 5.1 to versions prior to 5.4.270, 5.10.211, Trigger the bug, causing anchor being ...
CVE-2025-39682 - Security Bug Tracker - Debian
Name, CVE-2025-39682. Description, In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the ...
CVE-2025-39682
vulnerability has been resolved: A logic bug in the kTLS receive path mishandles zero-length records taken from the rx_list,…
CVE-2025-39682 - Critical Vulnerability (PoC Available)
CVE-2025-39682 is a Critical severity vulnerability (CVSS 9.8). In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each... Public Proof-of-Concept (PoC) exploit code and mitigation steps available.

🔴 CVE-2025-39682