What is CVE-2025-39682?
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.
The record classifies CVE-2025-39682 under weakness class CWE-754. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 404 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 9.8 — CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS (FIRST)
- 2.8% probability of exploitation in the next 30 days, higher than 86.4% of all scored CVEs
- CISA KEV
- Listed since 2026-09-18, federal remediation deadline 2026-09-21
- Threadlinqs priority
- 9/10 — CISA KEV-listed, which Threadlinqs floors at 9
- Published
- 2025-09-05, last modified 2026-10-07
Is CVE-2025-39682 being exploited?
CISA added CVE-2025-39682 to the Known Exploited Vulnerabilities catalog on 2026-09-18, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-09-21 under BOD 22-01. Weaponised exploit code for CVE-2025-39682 is publicly available. 3 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 50 in the Threadlinqs vulnerability feed.
- khoatran107/cve-2025-39682 (github)
- suominen/CVE-2025-39682 (github)
- trickest/cve (trickest)
Affected products and versions
- Linux: Linux
How to fix CVE-2025-39682
Because CVE-2025-39682 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-09-21. No vendor patch reference has been recorded for CVE-2025-39682 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.
Threat activity tracking CVE-2025-39682
2 tracked threats in the Threadlinqs corpus reference CVE-2025-39682, either in the campaign’s CVE list or as an indicator on the campaign record.
- CISA Flags Three Actively Exploited Linux Kernel Vulnerabilities: kTLS Receive-Path Disclosure/DoS, ebtables SNAT Privilege Escalation, and AF_ALG Race Condition (CVE-2025-39682, CVE-2026-53266, CVE-2025-39964) — CRITICAL · 2026-09-19
- CVE-2025-39682 — Linux Kernel net/tls rx_list Zero-Length Record Use-After-Free Added to CISA KEV Catalog — CRITICAL · 2026-09-18
Sources
Enriched from CVE.org, FIRST EPSS, CISA KEV, GitHub Security Advisories, public proof-of-concept repositories. Last verified by Threadlinqs on .