CVE Details
CVE-2025-39682
Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
Published: 2026-09-18
CVSS: 9.8 CRITICAL
Product: Linux Kernel
Due Date: 2026-09-21
Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.
GitHub PoC
Warning: GitHub PoC repositories are unverified. Some may be fake
or contain malware. Use caution and review code before running anything.
FIRST EPSS
EPSS estimates the probability of exploitation in the next 30 days. Higher values indicate higher likelihood of real-world exploitation.
Timeline
CVE Stalker
KEV
MITRE
GitHub
FIRST (EPSS)
MITRE
CVSS
SSVC
References
Show Raw Data
| Key | Remaining Key | Value |
|---|---|---|
| dataType | CVE_RECORD | |
| dataVersion | 5.2 | |
| cveMetadata > | cveId | CVE-2025-39682 |
| cveMetadata > | assignerOrgId | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| cveMetadata > | state | PUBLISHED |
| cveMetadata > | assignerShortName | Linux |
| cveMetadata > | dateReserved | 2025-04-16T07:20:57.113Z |
| cveMetadata > | datePublished | 2025-09-05T17:20:48.657Z |
| cveMetadata > | dateUpdated | 2026-09-18T19:27:06.348Z |
| containers > | cna > providerMetadata > orgId | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
| containers > | cna > providerMetadata > shortName | Linux |
| containers > | cna > providerMetadata > dateUpdated | 2026-08-05T12:04:31.384Z |
| containers > | cna > descriptions > 0 > lang | en |
| containers > | cna > descriptions > 0 > value | In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length. |
| containers > | cna > metrics > 0 > cvssV3_1 > version | 3.1 |
| containers > | cna > metrics > 0 > cvssV3_1 > vectorString | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| containers > | cna > metrics > 0 > cvssV3_1 > baseScore | 9.8 |
| containers > | cna > metrics > 0 > cvssV3_1 > baseSeverity | CRITICAL |
| containers > | cna > metrics > 0 > scenarios > 0 > lang | en |
| containers > | cna > metrics > 0 > scenarios > 0 > value | AV:N - The bug is triggered entirely by the sequence and content of TLS records arriving from the remote peer on a kTLS-enabled TCP socket (net/tls RX path); no local access is needed. Any kTLS RX consumer — OpenSSL-with-kTLS servers/clients, NFS-over-TLS, SMB/RPC-over-TLS via net/handshake — is remotely reachable over the network. AC:L - The attacker sends three back-to-back records ([DATA][zero-length non-DATA][DATA]) and the corruption occurs deterministically on the victim's ordinary recvmsg() loop, with no race to win and no memory-layout dependency; the kernel selftest added with the fix reproduces it in one shot. TLS 1.2 is zero-copy-capable by default (zc_capable = rx_no_pad || version != TLS_1_3_VERSION), so no unusual kernel config or sockopt is required. PR:N - The attacker is the remote TLS peer, which holds no privileges on the target system — an anonymous client completing a server-authenticated TLS handshake with a kTLS server, or a malicious server that a kTLS client connects to, suffices. This matches the repo's PR:N scoring of the comparable remote-peer net/tls bug CVE-2025-39946. UI:N - The victim application only has to run its normal recvmsg() loop on an already-established kTLS socket; no click, mount, file open, or any other victim action is required. The attacker drives the entire trigger from the wire. S:U - The corruption is confined to kernel skb/slab state within the same security authority; there is no VM, IOMMU, or sandbox boundary crossed. Standard in-kernel memory corruption is Scope:Unchanged. C:H - The strparser anchor is queued on rx_list after tcp_read_done() already released its backing TCP skbs, so the next recvmsg() copies freed kernel heap memory straight into the userspace buffer via skb_copy_datagram_msg(). This is a directly usable, repeatable kernel-memory disclosure primitive, not a bounded pointer leak. I:H - The live strp->anchor is consume_skb()'d by process_rx_list() while the strparser still uses it, after which incoming attacker-controlled TCP data is written into the freed sk_buff/skb_shared_info (skb_fill_page_desc, tls_strp_load_anchor_with_queue), and socket teardown double-frees the anchor and its frag_list skbs. This yields attacker-controlled write-after-free and freelist corruption suitable for control-flow hijack. A:H - The use-after-free and double-free of the anchor and of already-released TCP receive-queue skbs reliably corrupt slab state, producing oopses/panics and list corruption. Any remote peer can repeat this on every connection, giving a trivial remote kernel-crash DoS. |
| containers > | cna > affected > 0 > product | Linux |
| containers > | cna > affected > 0 > vendor | Linux |
| containers > | cna > affected > 0 > defaultStatus | unaffected |
| containers > | cna > affected > 0 > repo | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git |
| containers > | cna > affected > 0 > programFiles > 0 | net/tls/tls_sw.c |
| containers > | cna > affected > 0 > versions > 0 > version | 84c61fe1a75b4255df1e1e7c054c9e6d048da417 |
| containers > | cna > affected > 0 > versions > 0 > lessThan | 2902c3ebcca52ca845c03182000e8d71d3a5196f |
| containers > | cna > affected > 0 > versions > 0 > status | affected |
| containers > | cna > affected > 0 > versions > 0 > versionType | git |
| containers > | cna > affected > 0 > versions > 1 > version | 84c61fe1a75b4255df1e1e7c054c9e6d048da417 |
| containers > | cna > affected > 0 > versions > 1 > lessThan | c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677 |
| containers > | cna > affected > 0 > versions > 1 > status | affected |
| containers > | cna > affected > 0 > versions > 1 > versionType | git |
| containers > | cna > affected > 0 > versions > 2 > version | 84c61fe1a75b4255df1e1e7c054c9e6d048da417 |
| containers > | cna > affected > 0 > versions > 2 > lessThan | 3439c15ae91a517cf3c650ea15a8987699416ad9 |
| containers > | cna > affected > 0 > versions > 2 > status | affected |
| containers > | cna > affected > 0 > versions > 2 > versionType | git |
| containers > | cna > affected > 0 > versions > 3 > version | 84c61fe1a75b4255df1e1e7c054c9e6d048da417 |
| containers > | cna > affected > 0 > versions > 3 > lessThan | 29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e |
| containers > | cna > affected > 0 > versions > 3 > status | affected |
| containers > | cna > affected > 0 > versions > 3 > versionType | git |
| containers > | cna > affected > 0 > versions > 4 > version | 84c61fe1a75b4255df1e1e7c054c9e6d048da417 |
| containers > | cna > affected > 0 > versions > 4 > lessThan | 62708b9452f8eb77513115b17c4f8d1a22ebf843 |
| containers > | cna > affected > 0 > versions > 4 > status | affected |
| containers > | cna > affected > 0 > versions > 4 > versionType | git |
| containers > | cna > affected > 1 > product | Linux |
| containers > | cna > affected > 1 > vendor | Linux |
| containers > | cna > affected > 1 > defaultStatus | affected |
| containers > | cna > affected > 1 > repo | https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git |
| containers > | cna > affected > 1 > programFiles > 0 | net/tls/tls_sw.c |
| containers > | cna > affected > 1 > versions > 0 > version | 6.0 |
| containers > | cna > affected > 1 > versions > 0 > status | affected |
| containers > | cna > affected > 1 > versions > 1 > version | 0 |
| containers > | cna > affected > 1 > versions > 1 > lessThan | 6.0 |
| containers > | cna > affected > 1 > versions > 1 > status | unaffected |
| containers > | cna > affected > 1 > versions > 1 > versionType | semver |
| containers > | cna > affected > 1 > versions > 2 > version | 6.1.149 |
| containers > | cna > affected > 1 > versions > 2 > lessThanOrEqual | 6.1.* |
| containers > | cna > affected > 1 > versions > 2 > status | unaffected |
| containers > | cna > affected > 1 > versions > 2 > versionType | semver |
| containers > | cna > affected > 1 > versions > 3 > version | 6.6.103 |
| containers > | cna > affected > 1 > versions > 3 > lessThanOrEqual | 6.6.* |
| containers > | cna > affected > 1 > versions > 3 > status | unaffected |
| containers > | cna > affected > 1 > versions > 3 > versionType | semver |
| containers > | cna > affected > 1 > versions > 4 > version | 6.12.44 |
| containers > | cna > affected > 1 > versions > 4 > lessThanOrEqual | 6.12.* |
| containers > | cna > affected > 1 > versions > 4 > status | unaffected |
| containers > | cna > affected > 1 > versions > 4 > versionType | semver |
| containers > | cna > affected > 1 > versions > 5 > version | 6.16.4 |
| containers > | cna > affected > 1 > versions > 5 > lessThanOrEqual | 6.16.* |
| containers > | cna > affected > 1 > versions > 5 > status | unaffected |
| containers > | cna > affected > 1 > versions > 5 > versionType | semver |
| containers > | cna > affected > 1 > versions > 6 > version | 6.17 |
| containers > | cna > affected > 1 > versions > 6 > lessThanOrEqual | * |
| containers > | cna > affected > 1 > versions > 6 > status | unaffected |
| containers > | cna > affected > 1 > versions > 6 > versionType | original_commit_for_fix |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > operator | OR |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > negate | False |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionStartIncluding | 6.0 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 0 > versionEndExcluding | 6.1.149 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > versionStartIncluding | 6.0 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 1 > versionEndExcluding | 6.6.103 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > versionStartIncluding | 6.0 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 2 > versionEndExcluding | 6.12.44 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > versionStartIncluding | 6.0 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 3 > versionEndExcluding | 6.16.4 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > vulnerable | True |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > versionStartIncluding | 6.0 |
| containers > | cna > cpeApplicability > 0 > nodes > 0 > cpeMatch > 4 > versionEndExcluding | 6.17 |
| containers > | cna > references > 0 > url | https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f |
| containers > | cna > references > 1 > url | https://git.kernel.org/stable/c/c09dd3773b5950e9cfb6c9b9a5f6e36d06c62677 |
| containers > | cna > references > 2 > url | https://git.kernel.org/stable/c/3439c15ae91a517cf3c650ea15a8987699416ad9 |
| containers > | cna > references > 3 > url | https://git.kernel.org/stable/c/29c0ce3c8cdb6dc5d61139c937f34cb888a6f42e |
| containers > | cna > references > 4 > url | https://git.kernel.org/stable/c/62708b9452f8eb77513115b17c4f8d1a22ebf843 |
| containers > | cna > title | tls: fix handling of zero-length records on the rx_list |
| containers > | cna > x_generator > engine | bippy-1.2.0 |
| containers > | adp > 0 > title | CVE Program Container |
| containers > | adp > 0 > references > 0 > url | https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html |
| containers > | adp > 0 > providerMetadata > orgId | af854a3a-2127-422b-91ae-364da2661108 |
| containers > | adp > 0 > providerMetadata > shortName | CVE |
| containers > | adp > 0 > providerMetadata > dateUpdated | 2025-11-03T17:42:13.673Z |
| containers > | adp > 1 > x_adpType | supplier |
| containers > | adp > 1 > providerMetadata > orgId | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e |
| containers > | adp > 1 > providerMetadata > shortName | siemens-SADP |
| containers > | adp > 1 > providerMetadata > dateUpdated | 2026-05-12T12:06:08.852Z |
| containers > | adp > 1 > affected > 0 > vendor | Siemens |
| containers > | adp > 1 > affected > 0 > product | SIMATIC CN 4100 |
| containers > | adp > 1 > affected > 0 > versions > 0 > status | affected |
| containers > | adp > 1 > affected > 0 > versions > 0 > version | 0 |
| containers > | adp > 1 > affected > 0 > versions > 0 > lessThan | V5.0 |
| containers > | adp > 1 > affected > 0 > versions > 0 > versionType | custom |
| containers > | adp > 1 > affected > 0 > defaultStatus | unknown |
| containers > | adp > 1 > references > 0 > url | https://cert-portal.siemens.com/productcert/html/ssa-032379.html |
| containers > | adp > 2 > problemTypes > 0 > descriptions > 0 > type | CWE |
| containers > | adp > 2 > problemTypes > 0 > descriptions > 0 > cweId | CWE-754 |
| containers > | adp > 2 > problemTypes > 0 > descriptions > 0 > lang | en |
| containers > | adp > 2 > problemTypes > 0 > descriptions > 0 > description | CWE-754 Improper Check for Unusual or Exceptional Conditions |
| containers > | adp > 2 > references > 0 > url | https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-39682 |
| containers > | adp > 2 > references > 0 > tags > 0 | government-resource |
| containers > | adp > 2 > metrics > 0 > other > type | ssvc |
| containers > | adp > 2 > metrics > 0 > other > content > timestamp | 2026-09-18T19:25:58.427206Z |
| containers > | adp > 2 > metrics > 0 > other > content > id | CVE-2025-39682 |
| containers > | adp > 2 > metrics > 0 > other > content > options > 0 > Exploitation | active |
| containers > | adp > 2 > metrics > 0 > other > content > options > 1 > Automatable | yes |
| containers > | adp > 2 > metrics > 0 > other > content > options > 2 > Technical Impact | total |
| containers > | adp > 2 > metrics > 0 > other > content > role | CISA Coordinator |
| containers > | adp > 2 > metrics > 0 > other > content > version | 2.0.3 |
| containers > | adp > 2 > title | CISA ADP Vulnrichment |
| containers > | adp > 2 > providerMetadata > orgId | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| containers > | adp > 2 > providerMetadata > shortName | CISA-ADP |
| containers > | adp > 2 > providerMetadata > dateUpdated | 2026-09-18T19:27:06.348Z |