Signal is active with 14 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-21. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Priority
LOW
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
🛡️ We added Linux Kernel improper check for unusual or exceptional conditions vulnerability CVE-2025-39682 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/TAX5yszA2u
米国サイバーセキュリティ・社会基盤安全保障庁(CISA)が既知の悪用された脆弱性カタログに2件と1件の脆弱性を追加。全てLinuxカーネルで、CVE-2025-39964、CVE-2026-53266、CVE-2025-39682。対処期限は3日後の9/21。ランサムウェアによる悪用は不知。 https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-two-known-exploited-vulnerabilities-catalog https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-one-known-exploited-vulnerability-catalog
KEVに追加されたLinux KernelのCVE-2025-39682は - Ubuntu 24.04 - Ubuntu 22.04でHWE 6.8カーネルを使用している環境 - RHEL 9/10 あたりに影響が有りそう。リモート攻撃には、OpenSSLのkTLS対応など、受信側でkTLSを実際に利用するサービスが必要 KernelにKEVとなると影響が大きい。 PoC は 11ヶ月前に公開されている https://github.com/khoatran107/cve-2025-39682 改めてKEVと言うことは悪用が確認されたということだろうか
🚨 CISA ADDS LINUX KERNEL TLS CVE-2025-39682 TO KEV CISA has added CVE-2025-39682 (Linux Kernel TLS) to its Known Exploited Vulnerabilities Catalog (2026-09-18; catalog count noted at 1716) based on evidence of active exploitation. Per CISA / technical notes: • Improper check in the Linux Kernel TLS receive path • A zero-length record from rx_list can bypass intended recvmsg() record-type handling • Due date: 2026-09-21 · Forensic triage required: Yes ⚠️ Analyst Note: This is a THIRD same-day Linux Kernel KEV addition — distinct from today’s earlier pair (CVE-2025-39964 + CVE-2026-53266). Official CISA active-exploitation listing: patch ASAP and follow BOD 26-04 forensic-triage guidance where applicable. CISA alert: https://www.cisa.gov/news-events/alerts/2026/09/18/cisa-adds-one-known-exploited-vulnerability-catalog KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Kernel fix example: https://git.kernel.org/stable/c/2902c3ebcca52ca845c03182000e8d71d3a5196f NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-39682 #DDW #DarkWeb #CVE #Linux #KEV #ThreatIntelligence #CyberSecurity
Three Linux kernel vulnerabilities. All confirmed exploited by CISA on the same day. CVE-2025-39682 (CVSS 9.8): a remotely triggerable flaw in the TLS receive path. CVE-2026-53266 (8.8): an out-of-bounds write in netfilter's ebtables ARP rewrite. CVE-2025-39964 (7.8): a race condition in AF_ALG sockets that corrupts crypto operations. Federal deadline: September 21. If you run Linux, patch now. Details: http://vulntracker.io #Linux #CVE #CISA #VulnTracker
Who is hit: • CVE-2026-53266: unprivileged memory corruption when ebtables SNAT rewrites ARP into splice-backed page. Not default, but real on gateways. • CVE-2025-39964: AF_ALG concurrent writers → crypto corruption/DoS. • CVE-2025-39682: TLS mishandles zero-length rx_list.
CISA put 3 Linux kernel flaws on KEV yesterday—actively exploited. Federal due: Sep 21. CVE-2025-39682 (TLS zero-length rx_list), CVE-2026-53266 (ebtables SNAT ARP → OOB write), CVE-2025-39964 (AF_ALG race). Linux self-hosters/cloud VMs: update weekend, not “wait for LTS”
Federal deadline Monday, September 21. CISA (@CISAgov) added a third exploited Linux kernel flaw in one day. NVD scores it 7.1 local; the kernel's own CNA scores it 9.8 remote and unauthenticated. https://severitydaily.com/linux-kernel-ktls-cve-2025-39682-kev-third-addition-nvd-7-1-local-cna-9-8-remote/
🔒 #CyberSecurity CVE-2025-39682: Linux Kernel TLS Receive Path Flaw Added to CISA KEV — Detectio… "On Friday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three…" 🔗 https://securityarsenal.com/blog/cve-2025-39682-linux-kernel-tls-receive-path-flaw-added-to-cisa-kev-detection-and-remediation-guide #CyberSecurity #ThreatIntel #critical #zeroday #cve
@CISACyber The catalog row already sets the clock. CVE-2025-39682 was added 2026-09-18, due 2026-09-21, and forensic triage is marked required. If the vendor fix is not available, CISA's own action is to stop using the product, not to leave an end-of-life kernel in place.
🚨 CISA alerte sur l’exploitation active de 3 failles critiques du noyau Linux : patch d’urgence avant le 21 septembre 2026. La CVE-2025-39682 : 9.8 (Critical) selon https://kernel.org. #zoneantimalware https://zoneantimalware.com/cisa-linux-kernel-alerte-3/
@TheHackersNews CVE-2025-39964 is an AF_ALG socket race, CVE-2026-53266 an out-of-bounds write in the ebtables SNAT target, CVE-2025-39682 a zero-length record in the kernel TLS receive path. Added to KEV on the 18th, all three due the 21st. That is a three-day fuse.
CISA added 3 exploited Linux kernel CVEs to KEV, incl. CVE-2025-39682 (CVSS 9.8). First step: check running kernel versions against these CVEs and confirm patch status before any applicable deadlines. https://thehackernews.com/2026/09/cisa-flags-three-linux-kernel.html https://t.co/ZEoiZ2jCD8
Three severe Linux kernel vulnerabilities—CVE-2025-39682, CVE-2026-53266 & CVE-2025-39964—are now confirmed exploited in the wild. Red Hat’s advisories are live. US agencies face a patch deadline of September 21 under CISA’s KEV and BOD-26-04 mandates. Threats span privilege escalation, memory disclosure & DoS. Summary: audit local access, apply kernel updates fast. #SecurityNews #Linux #CVE #CISA #KernelVulnerabilities #PrivEsc #SecurityNews #Linux #Kernel #CVE #CISA #PrivEsc #Vulnerabilities https://thedailytechfeed.com/cisa-adds-three-critical-linux-kernel-bugs-to-exploited-list/
🔒 #CyberSecurity CVE-2025-39682: Linux Kernel TLS Receive Path Flaw Under Active Exploitation — … "On September 18, 2026, CISA added CVE-2025-39682 to the Known Exploited…" 🔗 https://securityarsenal.com/blog/cve-2025-39682-linux-kernel-tls-receive-path-flaw-under-active-exploitation-detection-and-remediation-guide #CyberSecurity #ThreatIntel #cve202539682 #critical #cisakev
CVE-2025-39682: Critical Linux Kernel KTLS Zero-Length Record Flaw A critical flaw in the Linux Kernel TLS receive path (CVE-2025-39682) allows unauthenticated remote memory corruption via crafted… Full write-up → link in bio #cybersecurity #infosec #cve #kev #linux https://t.co/8BrcEFq8qh
@CISACyber Active exploitation put CVE-2025-39682 (kernel TLS improper exceptional-condition check) on KEV. Inventory kTLS hosts, push vendor kernel updates first, and treat TLS offload boxes on older kernels as priority until patched.
🚨 CVE-2025-39682 is actively exploited via Linux kTLS. If your servers face the internet, Sept. 21 isn’t a patch deadline—it’s a countdown clock. https://windowsforum.com/news/cve-2025-39682-in-kev-patch-linux-ktls-before-sept-21.445003/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #LinuxSecurity #CisaKev #KernelTls #Cve202539682 https://t.co/mdfWFbumkC
Linux Kernel TLS CVE-2025-39682 added to CISA KEV today. Improper check for unusual or exceptional conditions. CISA cites active exploitation. Roll vendor kernel updates across managed fleets. Prioritize hosts using kernel TLS. #CVE #KEV
4 of 4 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 11.0 | - | - |
| OS | linux | linux_kernel | - | - | - |
| OS | linux | linux_kernel | 6.17 | - | - |
| OS | linux | linux_kernel | 6.17 | - | - |