CVE-2025-39682 is a flaw in the Linux kernel's net/tls subsystem, in the function tls_sw_recvmsg(), that mishandles a corner case where a zero-length TLS record is retrieved from the kernel's internal rx_list. Because TLS 1.3 record types are only known after decryption, the kernel's receive path queues a record whose type differs from the one currently being processed onto rx_list for the next recvmsg() call to consume. STAR Labs SG's technical analysis (the vulnerability's original reporters) shows that when the record pulled from rx_list is zero-length and kernel TLS zero-copy mode is active, the kernel incorrectly re-queues the anchor sk_buff, corrupting its reference count. On socket teardown this manifests as a use-after-free in tls_sw_release_resources_rx, which STAR Labs demonstrated (KASAN-confirmed, tested on Linux 6.12.41) as a local privilege-escalation primitive usable to gain root: an attacker establishes a TLS socket with TCP_ULP kernel-TLS offload and zero-copy enabled, sends an Application Data (0x17) record, sends a zero-length Handshake (0x16) record, partially reads the first record via read(conn, buf, 0x100) leaving copied==0 so the type commitment is never finalized, sends a second Application Data (0x17) record, calls recvmsg() to trigger the content-type-mismatch path, then closes the socket to trigger the UAF. No special container or namespace context is required — STAR Labs' PoC runs entirely as a standard local unprivileged user.

A public, independently authored exploit (GitHub: khoatran107/cve-2025-39682, described as a variant of CVE-2024-58239) fully weaponizes the primitive into reliable root code execution and reports an ~79/100 success rate against Google's kernelCTF mitigation-v4-6.6 hardened target instance. The exploitation chain: after triggering the UAF, the attacker uses splice() to pull the dangling anchor skb into a pipe, giving the freed page a second (writable) reference; ~128 pipe buffers are then filled with marker bytes as a heap spray so one pipe reclaims the freed page; the attacker forces page-table-entry (PTE) allocation via repeated mmap()/page-fault cycles so the buddy allocator hands the still-pipe-held freed page back out as a kernel page-table page — a classic cross-cache attack. Because a freshly faulted PTE initially points at the fixed kernel symbol empty_zero_page, reading it back through the pipe leaks a kernel pointer; masking flag bits and subtracting a fixed offset yields the runtime kernel base address, defeating KASLR without needing to bypass SMEP/SMAP (the write path goes through the pipe-buffer kernel structure rather than a direct user-controlled pointer dereference). The attacker then overwrites the reclaimed PTE to point at the physical address of the kernel's core_pattern sysctl, and writes a crash-handler string such as "|/proc/%P/fd/666 %P" through the pipe — hijacking the kernel's core-dump handler so that the next process crash on the system executes an attacker-controlled program as root.

The bug was introduced with Linux kernel 6.0 (released 2022-10-02; regression commit 84c61fe1a75b4255df1e1e7c054c9e6d048da417) and fixed upstream on 2025-09-05 across five stable branches: 6.1.149, 6.6.103, 6.12.44, 6.16.4, and 6.17-rc3. Downstream distributions shipped their own backports — Debian 11 (bullseye) linux-6.1 6.1.153-1~deb11u1 (LTS update published 2025-10-13, bundled with 400+ other kernel CVEs), Ubuntu via USN-7833-3 (AWS kernel, 2025-10-24) and the broader USN-7835/7928/7940/8188 series (24.04 LTS 6.8.0-86.87, 25.04 6.14.0-34.34), and Red Hat Enterprise Linux 9/10 via RHSA-2025:16880/16904 plus related EUS/SAP errata. The vulnerable Kernel TLS code is also present in the Android kernel: Google's Android Security Bulletin tracks it as ASB-A-440544511 ("possible use after free due to an incorrect bounds check in tls_sw_recvmsg of tls_sw.c"), rated High severity, local escalation of privilege with no additional execution privileges or user interaction needed, published 2026-03-01 and last modified 2026-09-11, fixed at the 2025-03-05 security patch level or later — meaning unpatched Android devices carry the same root-privesc exposure as desktop/server Linux. Siemens also bundled the fix into SIMATIC CN 4100 firmware V5.0 (advisory SSA-032379, listing CVE-2025-39682 itself at CVSS 3.1 7.0 among 167 CVEs the firmware update addresses in total); SIMATIC CN 4100 is a communication node used to connect third-party systems into process-control (OT) environments, extending exposure — and the standing DoS/crash risk from the underlying use-after-free — into industrial networks running embedded Linux, though Siemens' advisory does not itself narrate a device-specific exploitation scenario beyond "update to V5.0." Siemens' independently-published 7.0 score is a third distinct CVSS 3.1 value for this single CVE, alongside NVD's 7.1 (local) and the CNA's 9.8 (network) — three publishers, three numbers, underscoring how unsettled the scoring is.

STAR Labs' advisory and a follow-on n-day technical analysis (hackmd, unauthenticated author) both narrate the exploit at instruction-level detail. The PoC uses three TLS 1.2 records over a kernel-TLS (`TCP_ULP`) zero-copy socket: record 1 is Application Data (0x17) carrying an encrypted "Hello world" payload; record 2 is a zero-length Handshake (0x16) record; record 3 is a second Application Data (0x17) record. A `read(conn, buf, 0x100)` partially consumes record 1, leaving the internal `copied` counter at 0 so the content-type commitment for the stream is never finalized; the next `recvmsg()` then processes record 2 off `rx_list` and corrupts the anchor `sk_buff`'s reference count. STAR Labs' KASAN build surfaces this as a `slab-use-after-free` in `kfree_skb_list_reason`, reached when `tls_sw_release_resources_rx` walks memory it no longer owns that was originally allocated by `tcp_sendmsg_locked`. The khoatran107 write-up (itself explicitly framed as "a variant of CVE-2024-58239," a related prior kernel UAF/exploit-technique pairing) refines this into full root code execution without any kernel-version fingerprinting step (no `/proc/version`, `/proc/kallsyms`, `uname`, or `dmesg` probing is used) — instead it leaks the KASLR-defeating kernel base purely via the architecturally-fixed `empty_zero_page` symbol reachable through the corrupted page-table entry, and finishes by writing the literal string `|/proc/%P/fd/666 %P` into `core_pattern` through the captured pipe to hijack the next process crash into root code execution. No container, namespace, or cgroup-specific targeting is described; the exploit runs as a standard, unprivileged local process.

CISA added CVE-2025-39682 to its Known Exploited Vulnerabilities catalog on 2026-09-18 'based on evidence of active exploitation,' setting a federal remediation deadline of 2026-09-21 under BOD 26-04. Notably, the two published CVSS 3.1 scores for this CVE diverge sharply: NVD's own primary analysis and Red Hat's independent assessment rate it 7.1/High with a LOCAL attack vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H), consistent with the local-attacker PoC STAR Labs and khoatran107 documented, while a secondary CNA score rates it 9.8/Critical with a NETWORK vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) — plausibly reflecting that the vulnerable net/tls receive-path code is reachable by any remote TLS peer whose ciphertext is decrypted by a kTLS-offloading service (e.g. nginx, HAProxy, Kafka deployments using ktls), since TLS record type/length framing inside the encrypted stream is attacker-controlled by whichever peer is sending data. Both scores are legitimately published; defenders should treat this as capable of both local privilege escalation (now with a public, reliable, root-yielding exploit) and, on ktls-enabled network services, a remotely-influenced trigger, and should not assume the lower/local score bounds real-world exposure. CISA classifies the underlying weakness as CWE-754 (Improper Check for Unusual or Exceptional Conditions); STAR Labs' root-cause finding is CWE-416 (Use-After-Free); Siemens' advisory separately tags it CWE-20 (Improper Input Validation) — three descriptions of the same defect from three vantage points.