CVE-2025-39682

tls: fix handling of zero-length records on the rx_list

Exploited in the wild. In CISA KEV since 2026‑09‑18. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile86th2.9% chance in 30 days CISA KEVListedsince 2026-09-18, due 2026-09-21
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2025-09-05Updated 2026-09-19Sources: CVE.org, NVD, BDU, CSAF

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check every Linux server and appliance for its running kernel version and confirm with its operating-system vendor whether its installed security package includes CVE-2025-39682.
Install the vendor-provided kernel security update; for the upstream 6.1 branch, update to 6.1.149 or later.
Restart into the updated kernel and verify the running version after reboot.
If an update cannot be applied immediately, follow your vendor's mitigation guidance and prioritize internet-facing systems.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.

In plain language

Written by AI from the record

This is a critical flaw in unpatched Linux kernel systems that attackers are already using, so small businesses running Linux servers should treat it as an emergency.

CVE-2025-39682 is a network-reachable Linux kernel TLS handling flaw involving zero-length records on the rx_list, with impacts to confidentiality, integrity, and availability.

If you're affected

Server takeover
Sensitive data exposure
Data tampering
Service outages
Ransomware risk

What is it

The Linux kernel is the core software that runs a Linux server and helps it communicate securely over networks. This flaw can let an attacker misuse that communication handling like finding a faulty lock on a building's main control room, potentially exposing information, changing it, or interrupting operations.

Who is affected

This matters to you if you run Linux kernel systems, including Linux servers, virtual machines, network appliances, or products whose vendor supplies a Linux-based operating system. Ask the supplier of each managed appliance or cloud image whether its bundled Linux kernel includes the fix.

How urgent is it

Attackers are already exploiting this vulnerability in real-world attacks. Treat this as a red-alert issue: identify exposed systems now and get the vendor update installed on an emergency schedule.

What to do — in detail

Confirm exposure by inventorying Linux hosts, appliances, virtual-machine images, and vendor-managed products, then record the currently running kernel version and the installed kernel package version. Coordinate with each operating-system or appliance vendor because their package version may differ from the upstream Linux kernel number.

For the upstream Linux 6.1 maintenance branch, target 6.1.149 or later. The findings also identify upstream stable fixes in commits 2902c3ebcca52ca845c03182000e8d71d3a5196f, c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677, 3439c15ae91a517cf3c650ea15a8987699416ad9, 29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e, and 62708b9452f8eb77513115b17c4f8d1a22ebf843. Use the supported kernel update path from the operating-system or appliance vendor rather than manually applying individual commits.

Plan for a reboot, as a kernel update does not protect the running system until it boots the new kernel. If patching is delayed, use the vendor's documented mitigations; the findings do not provide a verified standalone workaround. CISA's KEV remediation due date is 2026-09-21. After deployment, verify the running kernel version, review for unexpected TLS-related crashes or abnormal network activity, and retain evidence of completed updates.

Technical context

Severity is CVSS 3.1 9.8 (Critical): AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is categorized as CWE-754 and concerns handling of zero-length TLS records on the Linux kernel rx_list path. CISA added CVE-2025-39682 to the Known Exploited Vulnerabilities catalog on 2026-09-18, confirming exploitation in the wild; one public GitHub proof of concept is also known. EPSS is 0.5% (42nd percentile) with a flat trend, but that prediction is superseded by confirmed exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS86th

Public exploit

CISA KEV

Listed as exploited in the wild since 2026-09-18.

US federal agencies must remediate by 2026-09-21.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

2.9% chance of exploitation activity in the next 30 days, which ranks it in the 86th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

A public exploit existed 67 days before the patch.

2026-09-19Patch availablerecord updated
2026-09-18Added to CISA KEVpatch available, patch available, record updated, record updated
2026-07-30Patch availablerecord updated
2026-06-25OpenVAS check added
2026-05-12Patch availablerecord updated
2026-03-07Public exploit / PoCsource: github-poc

Affected products

Сообщество свободного программного обеспеченияoss-projectaka fsf
- Debian GNU/LinuxOSOn-premOperating Systems / linux-distro
- LinuxOSOn-premOperating Systems / linux-distro
ООО «Ред Софт»commercial · RUaka red soft
- РЕД ОСOSOn-premOperating Systems / linux-distro
ООО «РусБИТех-Астра»commercial · RUaka rusbitech-astra
- Astra Linux Special EditionOSOn-premOperating Systems / linux-distro
Red Hat Inc.commercial · USaka red hat
- Red Hat Enterprise LinuxOSOn-premOperating Systems / linux-distro
Canonical Ltd.commercial · GBaka canonical
- UbuntuOSOn-premOperating Systems / linux-distro
АО «ИВК»commercial · RUaka ivk
- АЛЬТ СП 10OSOn-premOperating Systems / linux-distro

And 4 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

Sources

References in the record

And 287 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next exploited one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Debian GNU/Linux, not every advisory. This one: actively exploited.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account