CVE-2025-39682
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Lifecycle Timeline
3Description
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.
Analysis
This vulnerability in the Linux kernel's TLS receive path allows a local attacker with low privileges to cause a denial of service or potentially leak sensitive information in memory. The flaw occurs when handling zero-length TLS records on the rx_list, where the kernel fails to properly handle the corner case of zero-length initial records during zero-copy decryption operations. With an EPSS score of only 0.01% (1st percentile), active exploitation is highly unlikely despite the 7.1 CVSS score, and patches are available from the vendor.
Technical Context
The vulnerability affects the Linux kernel's TLS (Transport Layer Security) implementation, specifically in the record processing logic during recvmsg() system calls. According to the CPE data, affected versions include the Linux kernel across multiple version ranges and release candidates (6.17-rc1, 6.17-rc2), as well as Debian Linux 11.0. The issue stems from improper handling of zero-copy decryption when the initial record from the rx_list is zero-length. In TLS 1.3, record types are unknown until decryption completes, and the kernel must queue pending records of different types for subsequent recvmsg() calls. The vulnerability occurs because zero-copy operations decrypt directly to user space buffers without an skb to queue, and the code failed to account for zero-length initial records that could bypass type-change detection logic, potentially leading to memory corruption or information disclosure.
Affected Products
The Linux kernel is affected across multiple version ranges, with specific confirmation of versions leading up to and including release candidates 6.17-rc1 and 6.17-rc2 based on CPE data (cpe:2.3:o:linux:linux_kernel). Debian Linux 11.0 (cpe:2.3:o:debian:debian_linux:11.0) is also confirmed affected. The vulnerability impacts the kernel's TLS networking implementation, so any Linux distribution or embedded system running vulnerable kernel versions with TLS socket support is potentially at risk. Debian has issued a security advisory available at https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html addressing the issue in their Long Term Support release.
Remediation
Apply the vendor patches available from the Linux kernel stable tree at the following commits: 2902c3ebcca52ca845c03182000e8d71d3a5196f, 29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e, 3439c15ae91a517cf3c650ea15a8987699416ad9, 62708b9452f8eb77513115b17c4f8d1a22ebf843, and c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677 (see https://git.kernel.org/stable/c/). Debian users should follow guidance in the Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html and update to the patched kernel version through their distribution's package manager. As a temporary mitigation for environments where immediate patching is not feasible, consider restricting local user access to systems handling sensitive TLS communications and monitoring for unusual TLS socket operations, though this provides limited protection given the local nature of the vulnerability.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today