Skip to main content

Debian Linux CVE-2025-39682

HIGH
2025-09-05 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux Information Disclosure Debian Linux
7.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 17, 2026 - 20:45 vuln.today
Patch released
Mar 17, 2026 - 20:45 nvd
Patch available
CVE Published
Sep 05, 2025 - 18:15 nvd
HIGH 7.1

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

tls: fix handling of zero-length records on the rx_list

Each recvmsg() call must process either

  • only contiguous DATA records (any number of them)
  • one non-DATA record

If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there.

Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length).

Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.

AnalysisAI

This vulnerability in the Linux kernel's TLS receive path allows a local attacker with low privileges to cause a denial of service or potentially leak sensitive information in memory. The flaw occurs when handling zero-length TLS records on the rx_list, where the kernel fails to properly handle the corner case of zero-length initial records during zero-copy decryption operations. With an EPSS score of only 0.01% (1st percentile), active exploitation is highly unlikely despite the 7.1 CVSS score, and patches are available from the vendor.

Technical ContextAI

The vulnerability affects the Linux kernel's TLS (Transport Layer Security) implementation, specifically in the record processing logic during recvmsg() system calls. According to the CPE data, affected versions include the Linux kernel across multiple version ranges and release candidates (6.17-rc1, 6.17-rc2), as well as Debian Linux 11.0. The issue stems from improper handling of zero-copy decryption when the initial record from the rx_list is zero-length. In TLS 1.3, record types are unknown until decryption completes, and the kernel must queue pending records of different types for subsequent recvmsg() calls. The vulnerability occurs because zero-copy operations decrypt directly to user space buffers without an skb to queue, and the code failed to account for zero-length initial records that could bypass type-change detection logic, potentially leading to memory corruption or information disclosure.

RemediationAI

Apply the vendor patches available from the Linux kernel stable tree at the following commits: 2902c3ebcca52ca845c03182000e8d71d3a5196f, 29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e, 3439c15ae91a517cf3c650ea15a8987699416ad9, 62708b9452f8eb77513115b17c4f8d1a22ebf843, and c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677 (see https://git.kernel.org/stable/c/). Debian users should follow guidance in the Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html and update to the patched kernel version through their distribution's package manager. As a temporary mitigation for environments where immediate patching is not feasible, consider restricting local user access to systems handling sensitive TLS communications and monitoring for unusual TLS socket operations, though this provides limited protection given the local nature of the vulnerability.

More in Debian Linux

View all
CVE-2021-44228 CRITICAL POC
10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2022-30333 HIGH POC
7.5 May 09

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2018-7602 CRITICAL POC
9.8 Jul 19

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (
CVE-2021-40438 CRITICAL POC
9.0 Sep 16

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
CVE-2016-8735 CRITICAL POC
9.8 Apr 06

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
CVE-2026-24061 CRITICAL POC
9.8 Jan 21

GNU Inetutils telnetd through version 2.7 contains a critical authentication bypass that allows remote attackers to gain
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-4.42 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.57 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.80 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.95 Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.1 Affected

Share

CVE-2025-39682 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy