Skip to main content

Linux Kernel CVE-2025-39682

CRITICAL
Improper Check for Unusual or Exceptional Conditions (CWE-754)
2025-09-05 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Linux Debian Debian Linux
Critical
Disputed · 9.8 NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Establish kTLS session with target
  2. Delivery
    Send crafted zero-length TLS record
  3. Exploit
    Record queued to rx_list
  4. Execution
    Re-processed on next recvmsg()
  5. Persist
    Trigger unhandled corner case
  6. Impact
    Kernel DoS on TLS socket

Vulnerability Assessment

Weakness
CWE
CWE-754
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Unusual condition handling
Exploitation Conditions

Requires that the target host use the in-kernel TLS (kTLS) software data path - i.e., a socket with the TLS ULP enabled via setsockopt(TCP_ULP,'tls') and TLS_RX configured - which is a non-default, application-opt-in feature (used by some HTTPS/QUIC-adjacent and offload-capable services), not standard on typical deployments. The attacker must be the remote peer of an established TLS session and be able to send a record stream that produces a zero-length record re-entering processing from the rx_list. Affected versions per CPE are narrow: mainline 6.17-rc1/rc2 (plus distro backports covered by the Red Hat/SUSE/Debian errata); production stable kernels without the vulnerable change or already patched are not exposed. The corner-case nature (initial record from rx_list AND zero length) limits reliable triggering.
Impact

The signals for this CVE are sharply contradictory and must be read critically. The input CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), which is the auto-generated maximal score commonly attached to Linux kernel commit-derived CVEs rather than a hand-assessed value. The actual defect - mishandling of a zero-length TLS record pulled from rx_list in the kernel TLS (kTLS) software receive path (CWE-754, improper check) - is a robustness/corner-case bug whose realistic worst case is a kernel crash or misprocessing (denial of service), not the full confidentiality+integrity+availability compromise the vector implies. EPSS is 0.01% (1st percentile), indicating essentially no predicted exploitation. Most importantly, the input marks CISA KEV=YES ('actively exploited'), which directly conflicts with the near-zero EPSS, the obscure corner-case nature of the bug, and the fact that the CPE only lists 6.17-rc1/rc2 pre-release kernels plus Debian 11 - a KEV listing for an rc-only TLS zero-length edge case is highly implausible and should be treated as suspect feed data until verified directly against the CISA KEV catalog. Bottom line: this is most likely a low-real-risk hardening fix, NOT a genuine priority. If the KEV status were independently confirmed by CISA it would reverse this conclusion, so that single data point must be verified before deprioritizing.
Exploit ScenarioDerived

An attacker acting as the remote peer of an established kernel-TLS (kTLS) connection sends a crafted TLS record stream that causes a zero-length record to be queued to and later re-processed from the rx_list, hitting the unhandled corner case in the socket's recvmsg() path. The result is most plausibly a kernel-side processing fault / denial of service on the host terminating or servicing the TLS socket. The input claims public exploit code exists, but given the rc-only affected kernels and 0.01% EPSS this should be corroborated before being relied upon.
Act Now Prioritize within 24-48h. Why: In CISA KEV with patch available.
Exploited in the wild (CISA KEV) Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Sep 21, 2026

Improper handling of zero-length records in the Linux kernel's in-kernel TLS (kTLS) receive path can drive the kernel into an unrecoverable state, producing a denial of service on hosts that have explicitly enabled the TLS upper-layer protocol on sockets. Only deployments that opt in to kTLS with TLS_RX configured are exposed; the mainline code affected is 6.17-rc1/rc2, with exposure in production limited to distributions shipping the vulnerable backport (Red Hat, SUSE, Debian 11). Exploitation status is contradictory and must be weighed carefully: the record is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, yet EPSS is only 0.01% (1st percentile) and our independent assessment rates the vector as AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - availability-only impact behind a high-complexity, non-default precondition - rather than the 9.8 confidentiality/integrity/availability score published by NVD.

Earlier versions of this analysis (1)
v1 Mar 17, 2026 - 20:45 CVSS 7.1

This vulnerability in the Linux kernel's TLS receive path allows a local attacker with low privileges to cause a denial of service or potentially leak sensitive information in memory. The flaw occurs when handling zero-length TLS records on the rx_list, where the kernel fails to properly handle the corner case of zero-length initial records during zero-copy decryption operations. With an EPSS score of only 0.01% (1st percentile), active exploitation is highly unlikely despite the 7.1 CVSS score, and patches are available from the vendor.

RemediationAI

Apply the upstream fix, which is available as a set of stable-tree backports referenced in the advisory: https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f, https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e, https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9, https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843 and https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677; vendor-released patched kernels are distributed through RHSA-2025:16904, RHSA-2025:16880, RHSA-2025:19224, RHSA-2025:19223 and RHSA-2025:19104, SUSE-SU-2025:03600, SUSE-SU-2025:03601, SUSE-SU-2025:03602 and SUSE-SU-2025:03633, and the Debian LTS announcement at https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html. Because exposure is gated on the TLS ULP, a viable compensating control is to stop enabling kTLS receive on affected hosts - refrain from setsockopt(TCP_ULP, 'tls') with TLS_RX and fall back to user-space TLS libraries (OpenSSL/GnuTLS); the trade-off is increased CPU cost and loss of kernel/offload-accelerated decryption, and it must be validated per application since some high-throughput services depend on kTLS. Until patched, restrict or closely monitor TLS-terminating services that use kTLS and treat unexplained socket stalls or kernel faults in those processes as potential exploitation, given the confirmed actively exploited (CISA KEV) status.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the kernel TLS upper-layer protocol (TLS ULP), enabled per socket with setsockopt(TCP_ULP, 'tls') and configured through TLS_RX, which lets the kernel decrypt TLS records and deliver plaintext via recvmsg(). The receive path maintains an rx_list of records that were decrypted but not yet consumed, because each recvmsg() call must return either only contiguous DATA records or exactly one non-DATA record; when a record's type changes mid-call and it has already been decrypted - common in TLS 1.3, where the type is only known after decryption - the pending skb is queued to rx_list for the next call. Zero-copy decryption is permitted only for DATA records and decrypts straight into the user buffer, leaving no skb to queue. The missed corner case (classified CWE-754, improper check for unusual or exceptional conditions) occurs when the first record in a recvmsg() invocation arrives from rx_list and is zero length, allowing the code to zero-copy a record whose type subsequently appears to have changed and leaving processing in a state it cannot correctly resume. The affected kernel objects are the generic Linux kernel TLS receive implementation, tracked under the linux:linux_kernel CPE with mainline pipeline tags 6.17-rc1 and 6.17-rc2.

Know when Debian Linux gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
NVD PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.9 MEDIUM

Remote TLS peer can trigger it (AV:N/PR:N), but the specific rx_list zero-length corner case makes reliable triggering AC:H; impact is a kernel DoS only (A:H, C/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Red Hat 7.0 MEDIUM

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Severity Changed
Sep 21, 2026 - 12:07 NVD
HIGH CRITICAL
CVSS changed
Sep 21, 2026 - 12:07 NVD
7.1 (HIGH) 9.8 (CRITICAL)
Added to CISA KEV
Sep 18, 2026 - 19:33 CISA
Patch released
Mar 17, 2026 - 20:45 nvd
Patch available
CVE Published
Sep 05, 2025 - 18:15 nvd
HIGH 7.1

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

tls: fix handling of zero-length records on the rx_list

Each recvmsg() call must process either

  • only contiguous DATA records (any number of them)
  • one non-DATA record

If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there.

Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length).

Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.

Executive ViewAI

Why It Matters

A critical availability vulnerability in the Linux kernel's kTLS receive path can drive hosts that have explicitly enabled kTLS with TLS_RX into an unrecoverable state, causing denial-of-service outages for organizations running vulnerable Red Hat, SUSE, or Debian 11 kernels. The issue is confirmed actively exploited (CISA KEV) and publicly available exploit code exists, though exploitation depends on a non-default configuration and high-complexity conditions. Leadership should prioritize patching because unpatched production systems using this feature could suffer service disruption, while data confidentiality and integrity are not directly affected.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

Threat Score
7.0/10
Composite threat intelligence
EPSS Score
0.0%
Top 99% exploitable
Prevalence
Ubiquitous
Linux kernel, though the vulnerable kTLS software path is a niche feature
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Data Quality
7 sources
Confidence: High
NVD CVE.org CISA KEV EPSS CISA Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV Yes
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
In CISA KEV with patch available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Immediate
Exploitation· derived
Active
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

129
Low Medium High Critical
KEV: +50
EPSS: 0
CVSS: +49
PoC: +20
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Affected Products (CPE)NVD

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.17:rc2:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

More in Debian Linux

View all
CVE-2021-44228 CRITICAL POC
10.0 Dec 10

Apache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
CVE-2019-11043 CRITICAL POC
9.8 Oct 28

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it

CVE-2012-1823 CRITICAL POC
9.8 May 11

sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
CVE-2014-6271 CRITICAL POC
9.8 Sep 24

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
CVE-2017-7494 CRITICAL POC
9.8 May 30

Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2025-49113 CRITICAL POC
9.9 Jun 02

Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
CVE-2022-30333 HIGH POC
7.5 May 09

RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
CVE-2016-3714 HIGH POC
8.4 May 05

The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
CVE-2017-12617 HIGH POC
8.1 Oct 04

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
CVE-2020-1938 CRITICAL POC
9.8 Feb 24

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
CVE-2018-7602 CRITICAL POC
9.8 Jul 19

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (

Same weakness CWE-754 – Improper Check for Unusual or Exceptional Conditions

View all
CVE-2024-4367 HIGH POC
8.8
CVE-2017-11144 HIGH
7.5
CVE-2026-24054 CRITICAL POC
10.0
CVE-2023-37303 CRITICAL POC
9.8
CVE-2017-17085 HIGH POC
7.5
CVE-2020-6385 HIGH POC
8.8
CVE-2025-43715 HIGH POC
8.1
CVE-2023-21102 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:2.1.3-4.42 Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.57 Image SL-Micro Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.80 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.95 Affected
Container suse/sl-micro/6.0/toolbox:13.2-9.1 Affected

Threat IntelligenceMISP

CISA Advisories
ICSA-26-134-10
Sources: CISA (public domain)

References

Advisories & patches
PATCH https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f PATCH https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e PATCH https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9 PATCH https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843 PATCH https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677 ADVISORY https://access.redhat.com/errata/RHSA-2025:16880 ADVISORY https://access.redhat.com/errata/RHSA-2025:16904 ADVISORY https://access.redhat.com/errata/RHSA-2025:19104 ADVISORY https://access.redhat.com/errata/RHSA-2025:19223 ADVISORY https://access.redhat.com/errata/RHSA-2025:19224 ADVISORY https://vuldb.com/vuln/322893 ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03600/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03601/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03602/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03633/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:03634/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20851/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20861/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20870/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20898/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20994/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:20996/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21074/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21139/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:21179/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3725/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2025:3751/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0144/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0145/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0146/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0148/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0171/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0202/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0203/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0209/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0262/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0269/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0270/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0274/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0283/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0284/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20149/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20164/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20169/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20248/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20249/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20250/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20251/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20252/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20253/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20254/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20255/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20256/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20257/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20258/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20259/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20260/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20261/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20264/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20265/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20266/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20316/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20332/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20376/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20377/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20378/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20379/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20380/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20381/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20382/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20385/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20392/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20393/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20394/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20395/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20396/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20397/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20398/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20399/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20400/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20560/ REF https://cert-portal.siemens.com/productcert/html/ssa-032379.html REF https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html REF https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39682

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy