Skip to content
Fencer Vulns
critical 9.8

CVE-2025-39682 kev in the critical feed json

tls: fix handling of zero-length records on the rx_list

published 2025-09-05 14 mo ago modified 2026-10-19 20 d ago also EUVD-2025-31542

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2026-09-18
epss
3.3%
EPSS 3.3% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

tls: fix handling of zero-length records on the rx_list

Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record

If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there.

Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length).

Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.

Patch / fix

cisa required action Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

  • Linux Linux 6.1.149, 6.6.103, 6.12.44, 6.16.4, 6.17
  • Siemens SIMATIC CN 4100 V5.0
  • linux Debian 12 6.1.153-1
  • linux Debian 13 6.12.48-1
  • linux Debian 14 6.16.5-1

debian advisories DEBIAN-CVE-2025-39682

  • linux Ubuntu 24.04 LTS 6.8.0-86.87
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1041.43
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1042.45
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1038.43
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1039.39
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1041.47
  • linux-gkeop Ubuntu 24.04 LTS 6.8.0-1025.28
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1041.45

ubuntu advisories UBUNTU-CVE-2025-39682

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 10.0 6.12.0-55.37.1.el10_0
  • rv RHEL 10.0 6.12.0-55.37.1.el10_0
  • perf RHEL 10.0 6.12.0-55.37.1.el10_0
  • rtla RHEL 10.0 6.12.0-55.37.1.el10_0
  • libperf RHEL 10.0 6.12.0-55.37.1.el10_0
  • kernel-rt RHEL 10.0 6.12.0-55.37.1.el10_0
  • kernel-64k RHEL 10.0 6.12.0-55.37.1.el10_0
  • kernel-core RHEL 10.0 6.12.0-55.37.1.el10_0

red hat advisories RHSA-2025:19223RHSA-2025:19224RHSA-2025:19104RHSA-2025:16904RHSA-2025:16880

  • kernel-livepatch-SLE16_Update_0 SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 5-160000.4.3
  • kernel-livepatch-SLE16-RT_Update_0 Linux Micro 6.2 4-160000.3.4
  • kernel-livepatch-MICRO-6-0_Update_6 Linux Micro 6.1, Linux Micro 6.0 11-3.1
  • kernel-livepatch-MICRO-6-0-RT_Update_4 Linux Micro 6.1, Linux Micro 6.0 14-1.1
  • kernel-livepatch-MICRO-6-0-RT_Update_12 Linux Micro 6.1, Linux Micro 6.0 4-1.1
  • kernel-livepatch-MICRO-6-0-RT_Update_11 Linux Micro 6.1, Linux Micro 6.0 5-1.1
  • kernel-livepatch-MICRO-6-0_Update_4 Linux Micro 6.1, Linux Micro 6.0 15-1.2
  • kernel-livepatch-MICRO-6-0_Update_5 Linux Micro 6.1, Linux Micro 6.0 13-1.2

suse advisories SUSE-SU-2026:20149-1SUSE-SU-2026:20169-1SUSE-SU-2026:20164-1SUSE-SU-2026:0284-1SUSE-SU-2026:0283-1SUSE-SU-2026:0274-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.6.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.6.1
  • kernel-kvmsmall openSUSE Leap 16.0 6.12.0-160000.6.1

opensuse advisories openSUSE-SU-2025:20081-1

  • kernel AlmaLinux 9 5.14.0-570.49.1.el9_6
  • rv AlmaLinux 9 5.14.0-570.49.1.el9_6
  • perf AlmaLinux 9 5.14.0-570.49.1.el9_6
  • rtla AlmaLinux 9 5.14.0-570.49.1.el9_6
  • libperf AlmaLinux 9 5.14.0-570.49.1.el9_6
  • kernel-rt AlmaLinux 9 5.14.0-570.49.1.el9_6
  • kernel-64k AlmaLinux 9 5.14.0-570.49.1.el9_6
  • kernel-core AlmaLinux 9 5.14.0-570.49.1.el9_6

almalinux advisories ALSA-2025:16880ALSA-2025:16904

  • kernel Rocky Linux 9 5.14.0-570.49.1.el9_6
  • kernel Rocky Linux 10 6.12.0-55.37.1.el10_0

rocky linux advisories RLSA-2025:16880RLSA-2025:16904

  • kernel Azure Linux 3.0 6.6.104.2-1

azure linux advisories AZL-67001

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-39682 updated cvss 7.0

kernel: tls: fix handling of zero-length records on the rx_list

  • Red Hat CodeReady Linux Builder EUS (v.9.4) libperf 5.14.0-427.96.1.el9_4, kernel-debuginfo-common-s390x 5.14.0-427.96.1.el9_4, kernel-debuginfo-common-x86_64 5.14.0-427.96.1.el9_4, kernel-debuginfo-common-aarch64 5.14.0-427.96.1.el9_4, kernel-debuginfo-common-ppc64le 5.14.0-427.96.1.el9_4
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:19104
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-570.49.1.el9_6, perf 5.14.0-570.49.1.el9_6, rtla 5.14.0-570.49.1.el9_6, python3-perf 5.14.0-570.49.1.el9_6, kernel-devel-matched 5.14.0-570.49.1.el9_6, kernel-64k-devel-matched 5.14.0-570.49.1.el9_6, +7 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:16880
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-55.37.1.el10_0, perf 6.12.0-55.37.1.el10_0, rtla 6.12.0-55.37.1.el10_0, python3-perf 6.12.0-55.37.1.el10_0, kernel-devel-matched 6.12.0-55.37.1.el10_0, kernel-64k-devel-matched 6.12.0-55.37.1.el10_0, +7 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:16904
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) perf 5.14.0-284.144.1.el9_2, rtla 5.14.0-284.144.1.el9_2, kernel-devel-matched 5.14.0-284.144.1.el9_2, kernel-64k-devel-matched 5.14.0-284.144.1.el9_2, kernel-debug-devel-matched 5.14.0-284.144.1.el9_2, kernel-debuginfo-common-s390x 5.14.0-284.144.1.el9_2, +5 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:19224
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) rv 5.14.0-427.96.1.el9_4, perf 5.14.0-427.96.1.el9_4, rtla 5.14.0-427.96.1.el9_4, kernel-devel-matched 5.14.0-427.96.1.el9_4, kernel-64k-devel-matched 5.14.0-427.96.1.el9_4, kernel-debug-devel-matched 5.14.0-427.96.1.el9_4, +6 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:19104
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-570.49.1.el9_6, kernel-64k 5.14.0-570.49.1.el9_6, kernel-core 5.14.0-570.49.1.el9_6, kernel-tools 5.14.0-570.49.1.el9_6, kernel-modules 5.14.0-570.49.1.el9_6, kernel-64k-core 5.14.0-570.49.1.el9_6, +27 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:16880
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-55.37.1.el10_0, kernel-64k 6.12.0-55.37.1.el10_0, kernel-core 6.12.0-55.37.1.el10_0, kernel-tools 6.12.0-55.37.1.el10_0, kernel-modules 6.12.0-55.37.1.el10_0, kernel-64k-core 6.12.0-55.37.1.el10_0, +27 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:16904
  • Red Hat Enterprise Linux BaseOS E4S (v.9.2) bpftool 7.0.0-284.144.1.el9_2, kernel 5.14.0-284.144.1.el9_2, kernel-64k 5.14.0-284.144.1.el9_2, kernel-core 5.14.0-284.144.1.el9_2, kernel-tools 5.14.0-284.144.1.el9_2, python3-perf 5.14.0-284.144.1.el9_2, +28 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:19224
show 12 more
  • Red Hat Enterprise Linux BaseOS EUS (v.9.4) bpftool 7.3.0-427.96.1.el9_4, kernel 5.14.0-427.96.1.el9_4, kernel-64k 5.14.0-427.96.1.el9_4, kernel-core 5.14.0-427.96.1.el9_4, kernel-tools 5.14.0-427.96.1.el9_4, python3-perf 5.14.0-427.96.1.el9_4, +28 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:19104
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-570.49.1.el9_6, kernel-debuginfo-common-s390x 5.14.0-570.49.1.el9_6, kernel-debuginfo-common-x86_64 5.14.0-570.49.1.el9_6, kernel-debuginfo-common-aarch64 5.14.0-570.49.1.el9_6, kernel-debuginfo-common-ppc64le 5.14.0-570.49.1.el9_6
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:16880
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-55.37.1.el10_0, kernel-debuginfo-common-s390x 6.12.0-55.37.1.el10_0, kernel-debuginfo-common-x86_64 6.12.0-55.37.1.el10_0, kernel-debuginfo-common-aarch64 6.12.0-55.37.1.el10_0, kernel-debuginfo-common-ppc64le 6.12.0-55.37.1.el10_0
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:16904
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-570.49.1.el9_6, kernel-rt-64k 5.14.0-570.49.1.el9_6, kernel-rt-core 5.14.0-570.49.1.el9_6, kernel-rt-modules 5.14.0-570.49.1.el9_6, kernel-rt-64k-core 5.14.0-570.49.1.el9_6, kernel-rt-debug-core 5.14.0-570.49.1.el9_6, +14 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:16880
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-55.37.1.el10_0, kernel-rt-64k 6.12.0-55.37.1.el10_0, kernel-rt-core 6.12.0-55.37.1.el10_0, kernel-rt-modules 6.12.0-55.37.1.el10_0, kernel-rt-64k-core 6.12.0-55.37.1.el10_0, kernel-rt-debug-core 6.12.0-55.37.1.el10_0, +14 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:16904
  • Red Hat Enterprise Linux Real Time E4S (v.9.2) kernel-rt 5.14.0-284.144.1.rt14.429.el9_2, kernel-rt-core 5.14.0-284.144.1.rt14.429.el9_2, kernel-rt-modules 5.14.0-284.144.1.rt14.429.el9_2, kernel-rt-debug-core 5.14.0-284.144.1.rt14.429.el9_2, kernel-rt-modules-core 5.14.0-284.144.1.rt14.429.el9_2, kernel-rt-debug-modules 5.14.0-284.144.1.rt14.429.el9_2, +4 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:19223
  • Red Hat Enterprise Linux Real Time EUS (v.9.4) kernel-rt 5.14.0-427.96.1.el9_4, kernel-rt-core 5.14.0-427.96.1.el9_4, kernel-rt-modules 5.14.0-427.96.1.el9_4, kernel-rt-debug-core 5.14.0-427.96.1.el9_4, kernel-rt-modules-core 5.14.0-427.96.1.el9_4, kernel-rt-debug-modules 5.14.0-427.96.1.el9_4, +4 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:19104
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-570.49.1.el9_6, kernel-rt-kvm 5.14.0-570.49.1.el9_6, kernel-rt-core 5.14.0-570.49.1.el9_6, kernel-rt-modules 5.14.0-570.49.1.el9_6, kernel-rt-debug-kvm 5.14.0-570.49.1.el9_6, kernel-rt-debug-core 5.14.0-570.49.1.el9_6, +6 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:16880
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-55.37.1.el10_0, kernel-rt-kvm 6.12.0-55.37.1.el10_0, kernel-rt-core 6.12.0-55.37.1.el10_0, kernel-rt-modules 6.12.0-55.37.1.el10_0, kernel-rt-debug-kvm 6.12.0-55.37.1.el10_0, kernel-rt-debug-core 6.12.0-55.37.1.el10_0, +6 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:16904
  • Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2) kernel-rt 5.14.0-284.144.1.rt14.429.el9_2, kernel-rt-kvm 5.14.0-284.144.1.rt14.429.el9_2, kernel-rt-core 5.14.0-284.144.1.rt14.429.el9_2, kernel-rt-modules 5.14.0-284.144.1.rt14.429.el9_2, kernel-rt-debug-kvm 5.14.0-284.144.1.rt14.429.el9_2, kernel-rt-debug-core 5.14.0-284.144.1.rt14.429.el9_2, +6 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:19223
  • Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4) kernel-rt 5.14.0-427.96.1.el9_4, kernel-rt-kvm 5.14.0-427.96.1.el9_4, kernel-rt-core 5.14.0-427.96.1.el9_4, kernel-rt-modules 5.14.0-427.96.1.el9_4, kernel-rt-debug-kvm 5.14.0-427.96.1.el9_4, kernel-rt-debug-core 5.14.0-427.96.1.el9_4, +6 more
    fixed: vendor fix “To mitigate this issue, prevent module tls from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.” RHSA-2025:19104
  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA SSVC: exploitation active
  4. CISA patch deadline

Known exploited

Added
52 d ago
Patch by
2026-09-21 (49 d ago)
Ransomware
Not known
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Vendor, product
Linux, Kernel
CISA name
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
51 d ago

Exploit prediction

3.31% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux
  • Siemens SIMATIC CN 4100

Classification

Weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.